@mutmutco/cli 3.93.0 → 3.95.0

package/dist/main.cjs

@@ -3416,8 +3416,8 @@ var program = new Command();
 
 // src/index.ts
 var import_promises11 = require("node:fs/promises");
-var import_node_fs36 = require("node:fs");
-var import_node_child_process16 = require("node:child_process");
+var import_node_fs39 = require("node:fs");
+var import_node_child_process18 = require("node:child_process");
 
 // src/cli-shared.ts
 var import_node_child_process3 = require("node:child_process");
@@ -6993,11 +6993,13 @@ function commandLadderHint() {
   }
   lines.push("[mmi] Schedules doctrine (#3228): scheduled jobs + LLM crons go through the Hub registry \u2014 eight-field header \u2192 PR \u2192 `mmi-cli org schedules register`; LLM crons ONLY via the harbour (llm: yes \u21D2 executor cursor-agent). Never hand-build an unregistered cron. Opt out per repo: `mmi-cli org schedules mode self-managed`.");
   lines.push('[mmi] Registering \u2260 armed (#3281): `org schedules register` writes SCHEDULE# rows; the fleet-clock reconciler arms them within ~15 min. Report "registered successfully \u2014 arms on the next fleet-clock tick", never "armed"/"live". The success JSON carries an `arming` block. Before that window an absent clock means "not reconciled yet", NOT "will never fire" \u2014 verify with `mmi-cli org schedules` after it.');
+  lines.push("[mmi] Current-state doors (#4120): prefer `org schedules`, `runtime box list`, `org project get`, `board`/`status`/`next`, `docs index` over markdown inventories or janitor prose \u2014 see docs/Architecture/compute-at-read.md.");
+  lines.push("[mmi] Estate structure search (#4133): `mmi-cli repo-index search <q>` hits Hub cloud (lexical/hybrid; `--semantic` for meaning). Pointer hits only \u2014 never invent wiki prose or trust living `docs/**` current-state. Local rebuild is optional (`--local`); laptops do not index the estate.");
   return lines.join("\n");
 }
 
 // src/index.ts
-var import_node_path35 = require("node:path");
+var import_node_path38 = require("node:path");
 
 // src/merge-ci-policy.ts
 function resolveMergeCiPolicy(input) {
@@ -11706,6 +11708,29 @@ function parseAuthoritativeRuleset(raw, meta, repo) {
 function sameContexts(left, right) {
   return left.length === right.length && left.every((context, index) => context === right[index]);
 }
+function resolveProductRulesetReconcilePlan(input) {
+  const liveNeedsContextConvergence = !sameContexts(input.liveContexts, input.authorityContexts);
+  const liveIsActive = input.liveEnforcement === "active";
+  if (liveIsActive && !liveNeedsContextConvergence) {
+    return { shouldActivate: false, targetEnforcement: "active" };
+  }
+  if (input.unsafeContexts.length > 0) {
+    const unsafe = [...input.unsafeContexts];
+    return {
+      shouldActivate: false,
+      targetEnforcement: "disabled",
+      holdReason: `product ruleset left non-enforcing \u2014 [${unsafe.join(", ")}] ${unsafe.length === 1 ? "is" : "are"} emitted ONLY by path-filtered workflow(s), so the context is not reported on a PR outside those paths and requiring it would block that PR forever (#3836). Give the gate a companion job that runs unconditionally, then re-run this command`
+    };
+  }
+  if (!input.gateProvenGreen) {
+    return {
+      shouldActivate: false,
+      targetEnforcement: "disabled",
+      holdReason: "product ruleset left non-enforcing \u2014 the gate is not green on development; activating it would block every PR (#3694)"
+    };
+  }
+  return { shouldActivate: true, targetEnforcement: "active" };
+}
 async function contentExists(deps, repo, branch, path2) {
   try {
     const encodedPath = path2.split("/").map(encodeURIComponent).join("/");
@@ -12409,46 +12434,39 @@ async function applyCiReconcileRepo(repo, deps) {
     return finalizeCiReconcile(repo, deps, result, report);
   }
   const liveContexts = live == null ? [] : sortedUnique(rulesetRequiredContexts(live));
-  const liveNeedsConvergence = live == null || !sameContexts(liveContexts, authority.contexts);
-  const enforcement = live?.enforcement === "disabled" || live == null && authority.apiPayload.enforcement === "disabled" ? "disabled" : "active";
-  if (liveNeedsConvergence && enforcement === "active") {
-    const prWorkflows = await prTriggeredWorkflowsOnRef(deps, repo, baseBranch, "deployable") ?? [];
-    const gateFiles = gateWorkflowFiles(prWorkflows);
-    const allPrWorkflows = await listWorkflowPaths(deps, repo, baseBranch) ?? [];
-    const bodies = [];
-    for (const path2 of allPrWorkflows) {
-      const body = await fetchFileContent(deps, repo, baseBranch, path2);
-      if (body) bodies.push({ path: path2, body });
-    }
-    const filteredPaths = new Set(pathFilteredPullRequestWorkflows(bodies).filter((p) => !p.endsWith("/agent-pr.yml")));
-    const safeContexts = new Set(collectPullRequestWorkflowContexts(bodies.filter((b) => !filteredPaths.has(b.path))));
-    const unsafe = collectPullRequestWorkflowContexts(bodies.filter((b) => filteredPaths.has(b.path))).filter((c) => authority.contexts.includes(c) && !safeContexts.has(c));
-    if (unsafe.length) {
-      const reason = `product ruleset left non-enforcing \u2014 [${unsafe.join(", ")}] ${unsafe.length === 1 ? "is" : "are"} emitted ONLY by path-filtered workflow(s) (${[...filteredPaths].join(", ")}), so the context is not reported on a PR outside those paths and requiring it would block that PR forever (#3836). Give the gate a companion job that runs unconditionally, then re-run this command`;
-      result.skipped.push(reason);
-      return finalizeCiReconcile(repo, deps, result, report, reason);
-    }
-    if (!await gateIsProvenGreen(repo, deps.client, baseBranch, gateFiles)) {
-      const reason = "product ruleset left non-enforcing \u2014 the gate is not green on development; activating it would block every PR (#3694)";
-      result.skipped.push(reason);
-      return finalizeCiReconcile(repo, deps, result, report, reason);
-    }
-  }
-  if (liveNeedsConvergence) {
-    try {
-      const activation = await activateProductRuleset(repo, authority.apiPayload, deps.client, enforcement);
-      if (activation.action === "skipped") result.skipped.push(activation.detail ?? "product ruleset");
-      else result.applied.push(`product ruleset ${activation.action}${activation.detail ? `: ${activation.detail}` : ""}`);
-    } catch (e) {
-      result.errors.push(e.message);
-      return finalizeCiReconcile(repo, deps, result, report);
+  const prWorkflows = await prTriggeredWorkflowsOnRef(deps, repo, baseBranch, "deployable") ?? [];
+  const gateFiles = gateWorkflowFiles(prWorkflows);
+  const allPrWorkflows = await listWorkflowPaths(deps, repo, baseBranch) ?? [];
+  const bodies = [];
+  for (const path2 of allPrWorkflows) {
+    const body = await fetchFileContent(deps, repo, baseBranch, path2);
+    if (body) bodies.push({ path: path2, body });
+  }
+  const filteredPaths = new Set(pathFilteredPullRequestWorkflows(bodies).filter((p) => !p.endsWith("/agent-pr.yml")));
+  const safeContexts = new Set(collectPullRequestWorkflowContexts(bodies.filter((b) => !filteredPaths.has(b.path))));
+  const unsafe = collectPullRequestWorkflowContexts(bodies.filter((b) => filteredPaths.has(b.path))).filter((c) => authority.contexts.includes(c) && !safeContexts.has(c));
+  const plan = resolveProductRulesetReconcilePlan({
+    liveEnforcement: live?.enforcement,
+    liveContexts,
+    authorityContexts: authority.contexts,
+    gateProvenGreen: await gateIsProvenGreen(repo, deps.client, baseBranch, gateFiles),
+    unsafeContexts: unsafe
+  });
+  if (!plan.shouldActivate) {
+    if (plan.holdReason) {
+      result.skipped.push(plan.holdReason);
+      return finalizeCiReconcile(repo, deps, result, report, plan.holdReason);
     }
-  } else {
     result.skipped.push(`live ${PRODUCT_RULESET_NAME} contexts already match ${authority.source}`);
+    return finalizeCiReconcile(repo, deps, result, report);
   }
-  if (enforcement === "disabled") {
-    const reason = `${PRODUCT_RULESET_NAME} remains parked (disabled); authoritative contexts were preserved without changing enforcement`;
-    return finalizeCiReconcile(repo, deps, result, report, reason);
+  try {
+    const activation = await activateProductRuleset(repo, authority.apiPayload, deps.client, plan.targetEnforcement);
+    if (activation.action === "skipped") result.skipped.push(activation.detail ?? "product ruleset");
+    else result.applied.push(`product ruleset ${activation.action}${activation.detail ? `: ${activation.detail}` : ""}`);
+  } catch (e) {
+    result.errors.push(e.message);
+    return finalizeCiReconcile(repo, deps, result, report);
   }
   return finalizeCiReconcile(repo, deps, result, report);
 }
@@ -13303,7 +13321,7 @@ async function executeWaveLand(plan, deps, opts = { preserveWorktree: true }) {
 }
 
 // src/index.ts
-var import_node_os14 = require("node:os");
+var import_node_os15 = require("node:os");
 
 // src/board.ts
 var import_node_child_process9 = require("node:child_process");
@@ -15089,9 +15107,9 @@ function parseSecretsUseArgv(tail) {
   const flags = {};
   const keys = [];
   const firstSep = tail.indexOf("--");
-  const sep2 = firstSep !== -1 && separatorIsOurs(tail.slice(0, firstSep)) ? firstSep : -1;
-  const head = sep2 === -1 ? tail : tail.slice(0, sep2);
-  let command = sep2 === -1 ? [] : tail.slice(sep2 + 1).slice();
+  const sep3 = firstSep !== -1 && separatorIsOurs(tail.slice(0, firstSep)) ? firstSep : -1;
+  const head = sep3 === -1 ? tail : tail.slice(0, sep3);
+  let command = sep3 === -1 ? [] : tail.slice(sep3 + 1).slice();
   for (let i = 0; i < head.length; ) {
     const tok = head[i];
     const eq = tok.indexOf("=");
@@ -17215,11 +17233,11 @@ var PRIMARY_GROUPS = [
   // `tests` sits beside `docs` deliberately: both are deterministic, repo-local gates a workflow
   // step invokes (`docs refs`, `tests policy`), not org-plane operations (#3605). `spawn policy`
   // joins them on the same footing (#3979).
-  ["Setup and support", ["bootstrap", "secrets", "docs", "tests", "spawn"]],
+  ["Setup and support", ["bootstrap", "secrets", "docs", "repo-index", "tests", "spawn"]],
   ["Coordinate and improve", ["wave", "report", "skill-lesson"]]
 ];
 var OPERATIONAL_TOP_LEVEL = /* @__PURE__ */ new Set(["org", "runtime", "plugin"]);
-var SUPPORT_PRIMARY = /* @__PURE__ */ new Set(["doctor", "whoami", "commands", "explain", "docs", "tests", "spawn", "wave", "report", "skill-lesson"]);
+var SUPPORT_PRIMARY = /* @__PURE__ */ new Set(["doctor", "whoami", "commands", "explain", "docs", "repo-index", "tests", "spawn", "wave", "report", "skill-lesson"]);
 var TOP_LEVEL_ORDER = /* @__PURE__ */ new Map();
 var HELP_GROUP_ORDER = /* @__PURE__ */ new Map();
 var topLevelPosition = 0;
@@ -17258,6 +17276,7 @@ var COMMAND_OWNERSHIP = {
   bootstrap: { module_owner: "cli/src/bootstrap-commands.ts", consumer: "repo-bootstrap" },
   secrets: { module_owner: "cli/src/secrets-commands.ts", consumer: "authenticated-operator" },
   docs: { module_owner: "cli/src/docs-index-command.ts", consumer: "repo-gates" },
+  "repo-index": { module_owner: "cli/src/repo-index.ts", consumer: "agent-session" },
   tests: { module_owner: "cli/src/test-policy-core.ts", consumer: "repo-gates" },
   spawn: { module_owner: "cli/src/spawn-policy-core.ts", consumer: "repo-gates" },
   wave: { module_owner: "cli/src/wave-land.ts", consumer: "campaign-orchestrator" },
@@ -19282,210 +19301,866 @@ function renderAccessReport(report) {
   return lines.join("\n");
 }
 
-// src/spawn-policy-core.ts
+// src/repo-index.ts
+var import_node_crypto4 = require("node:crypto");
 var import_node_child_process11 = require("node:child_process");
 var import_node_fs22 = require("node:fs");
 var import_node_path20 = require("node:path");
-var SPAWNERS = ["spawn", "spawnSync", "exec", "execSync", "execFile", "execFileSync"];
-var CALL_SOURCE = String.raw`(^|[^.\w$])(${SPAWNERS.join("|")})\s*\(`;
-var SOURCE_EXT = /\.(ts|mts|cts|js|mjs|cjs)$/;
-var EXCLUDED = [
-  /(^|\/)node_modules\//,
-  /(^|\/)(dist|build|coverage)\//,
-  /(^|\/)(test|tests|__tests__|fixtures|__fixtures__)\//,
-  /\.(test|spec)\.[cm]?[jt]s$/,
-  /\.d\.[cm]?ts$/
+var REPO_INDEX_SCHEMA = 1;
+var HARD_DENY = [
+  /(^|\/)\.env(\.|$)/i,
+  /(^|\/)\.env\./i,
+  /credentials/i,
+  /secrets?\.json$/i,
+  /\.pem$/i,
+  /\.p12$/i,
+  /\.key$/i,
+  /(^|\/)id_rsa/i,
+  /(^|\/)id_ed25519/i,
+  /\.keystore$/i
 ];
-function stripComments(src) {
-  return src.replace(/\/\*[\s\S]*?\*\//g, (m) => m.replace(/[^\n]/g, " ")).replace(/(^|[^:])\/\/[^\n]*/g, (m, p) => p + " ".repeat(m.length - p.length));
+var INDEXABLE_EXT = /* @__PURE__ */ new Set([
+  ".ts",
+  ".tsx",
+  ".js",
+  ".jsx",
+  ".mjs",
+  ".cjs",
+  ".py",
+  ".go",
+  ".rs",
+  ".java",
+  ".kt",
+  ".md",
+  ".yml",
+  ".yaml",
+  ".json",
+  ".toml",
+  ".sh",
+  ".ps1",
+  ".css",
+  ".html"
+]);
+var SYMBOL_RE = /^(?:export\s+)?(?:async\s+)?(?:function|class|const|let|var|type|interface|enum)\s+([A-Za-z_$][\w$]*)/gm;
+function repoIndexStorePath(cwd) {
+  return repoRuntimeStatePath(cwd, "repo-index", "index.json");
+}
+function isHardDeniedPath(relPosix) {
+  return HARD_DENY.some((re) => re.test(relPosix));
+}
+function isIndexablePath(relPosix) {
+  if (isHardDeniedPath(relPosix)) return false;
+  if (relPosix.startsWith(".git/")) return false;
+  if (relPosix.includes("node_modules/")) return false;
+  if (relPosix.includes("dist/")) return false;
+  const dot = relPosix.lastIndexOf(".");
+  if (dot < 0) return false;
+  return INDEXABLE_EXT.has(relPosix.slice(dot).toLowerCase());
+}
+function extractSymbols(source) {
+  const out = /* @__PURE__ */ new Set();
+  SYMBOL_RE.lastIndex = 0;
+  let m;
+  while ((m = SYMBOL_RE.exec(source)) !== null) {
+    if (m[1]) out.add(m[1]);
+  }
+  return [...out].sort((a, b) => a.localeCompare(b));
 }
-function callArgs(src, open2) {
-  let depth = 0;
-  for (let i = open2; i < src.length; i++) {
-    const c = src[i];
-    if (c === "(") depth++;
-    else if (c === ")") {
-      depth--;
-      if (depth === 0) return src.slice(open2, i + 1);
+var BLURB_CAP = 200;
+function extractModuleBlurb(source) {
+  const lines = source.split(/\r?\n/);
+  let i = 0;
+  while (i < lines.length) {
+    const t = lines[i].trim();
+    if (!t || t.startsWith("#!") || /^['"]use (strict|client|server)['"]/.test(t)) {
+      i++;
+      continue;
     }
+    break;
   }
-  return "";
-}
-function findViolationsInSource(raw) {
-  if (!/from\s+["']node:child_process["']/.test(raw)) return [];
-  const importBlock = /import\s*(?:type\s*)?\{([^}]*)\}\s*from\s+["']node:child_process["']/.exec(raw);
-  const imported = new Set(
-    (importBlock?.[1] ?? "").split(",").map((s) => s.trim().split(/\s+as\s+/)[0].trim()).filter(Boolean)
-  );
-  if (imported.size === 0) return [];
-  const rawLines = raw.split("\n");
-  const src = stripComments(raw);
-  const call = new RegExp(CALL_SOURCE, "g");
-  const found = [];
-  let m;
-  while (m = call.exec(src)) {
-    const callee = m[2];
-    if (!imported.has(callee)) continue;
-    const open2 = m.index + m[0].length - 1;
-    const args = callArgs(src, open2);
-    if (!args) continue;
-    if (args.includes("windowsHide")) continue;
-    const line = src.slice(0, m.index + m[1].length).split("\n").length;
-    if (/windows-hide-exempt:/.test(rawLines[line - 2] ?? "")) continue;
-    if (/\.{3}\s*\w+/.test(args)) continue;
-    if (/\b(opts|options|spawnOptions)\b/.test(args)) continue;
-    const identifiers = new Set(args.match(/\b[A-Za-z_$][\w$]*\b/g) ?? []);
-    let satisfied = false;
-    for (const id of identifiers) {
-      if (SPAWNERS.includes(id)) continue;
-      const decl = new RegExp(String.raw`\b(?:const|let|var)\s+${id}\b[^;]*`, "s").exec(src);
-      if (decl && decl[0].includes("windowsHide")) {
-        satisfied = true;
-        break;
-      }
-      if (new RegExp(String.raw`\b${id}\s*:\s*\{[^}]*windowsHide`, "s").test(src)) {
-        satisfied = true;
-        break;
-      }
+  if (i >= lines.length) return void 0;
+  const first = lines[i].trim();
+  if (first.startsWith("/**")) {
+    const same = first.replace(/^\/\*\*\s*/, "").replace(/\*\/\s*$/, "").replace(/^\*\s?/, "").trim();
+    if (same && !same.startsWith("*") && same !== "/") return same.slice(0, BLURB_CAP);
+    for (let j = i + 1; j < Math.min(i + 12, lines.length); j++) {
+      const raw = lines[j].trim();
+      if (raw.startsWith("*/")) break;
+      const content = raw.replace(/^\*\s?/, "").trim();
+      if (!content || content.startsWith("@")) continue;
+      return content.slice(0, BLURB_CAP);
     }
-    if (satisfied) continue;
-    found.push({ line, callee });
+    return void 0;
   }
-  return found;
+  if (first.startsWith("//")) {
+    const content = first.replace(/^\/\/\s?/, "").trim();
+    return content ? content.slice(0, BLURB_CAP) : void 0;
+  }
+  if (first.startsWith("#")) {
+    const content = first.replace(/^#+\s?/, "").trim();
+    return content ? content.slice(0, BLURB_CAP) : void 0;
+  }
+  return void 0;
 }
-function policedFiles(root) {
-  const r = (0, import_node_child_process11.spawnSync)("git", ["ls-files", "-z", "--cached", "--others", "--exclude-standard"], {
-    cwd: root,
-    encoding: "utf8",
-    windowsHide: true,
-    maxBuffer: 32 * 1024 * 1024
-  });
-  if (r.status !== 0) {
-    throw new Error(`spawn policy: git ls-files failed: ${(r.stderr || "").trim() || `exit ${r.status}`}`);
+function extractReadmeSectionHeaders(markdown, limit = 6) {
+  const out = [];
+  for (const line of markdown.split(/\r?\n/)) {
+    const m = /^(#{1,3})\s+(.+?)\s*$/.exec(line.trim());
+    if (!m?.[2]) continue;
+    const title = m[2].replace(/#+\s*$/, "").trim();
+    if (!title) continue;
+    out.push(title);
+    if (out.length >= limit) break;
   }
-  return (r.stdout ?? "").split("\0").filter(Boolean).filter((f) => SOURCE_EXT.test(f)).filter((f) => !EXCLUDED.some((re) => re.test(f)));
+  return out;
 }
-function runSpawnPolicy(root) {
-  const files = policedFiles(root);
-  const findings = [];
-  for (const file of files) {
-    let raw;
+function loadReadmeHints(cwd, candidatePaths) {
+  const hints = /* @__PURE__ */ new Map();
+  const readmes = /* @__PURE__ */ new Set();
+  if (candidatePaths.includes("README.md")) readmes.add("README.md");
+  for (const p of candidatePaths) {
+    const parts = p.split("/");
+    if (parts.length === 2 && parts[1] === "README.md" && parts[0]) readmes.add(p);
+  }
+  for (const rel of readmes) {
+    if (isHardDeniedPath(rel)) continue;
+    const abs = (0, import_node_path20.join)(cwd, ...rel.split("/"));
+    if (!(0, import_node_fs22.existsSync)(abs)) continue;
+    let text;
     try {
-      raw = (0, import_node_fs22.readFileSync)((0, import_node_path20.join)(root, file), "utf8");
+      text = (0, import_node_fs22.readFileSync)(abs, "utf8");
     } catch {
       continue;
     }
-    for (const v of findViolationsInSource(raw)) {
-      findings.push({
-        file,
-        line: v.line,
-        callee: v.callee,
-        detail: `${file}:${v.line} ${v.callee}(...) has no windowsHide`
-      });
-    }
+    if (text.length > 2e5) continue;
+    const headers = extractReadmeSectionHeaders(text);
+    if (!headers.length) continue;
+    const key = rel.includes("/") ? rel.split("/")[0] : "";
+    hints.set(key, headers.join("; ").slice(0, BLURB_CAP));
   }
-  return { ok: findings.length === 0, scannedCount: files.length, findings };
+  return hints;
 }
-
-// src/test-policy-core.ts
-var import_node_child_process12 = require("node:child_process");
-var import_node_fs23 = require("node:fs");
-var import_node_path21 = require("node:path");
-var POLICY_FILE = "test-policy.json";
-var TEST_RE = /\.(?:test|spec)\.[cm]?[jt]sx?$/;
-var PY_TEST_RE = /(?:^|\/)test_[^/]*\.py$|_test\.py$/;
-var TRAILER_KEY = "Test-Policy-Override";
-var OVERRIDE_RE = /^Test-Policy-Override:\s*(.+)$/im;
-var REC = "";
-var FLD = "";
-var WAIVABLE_KINDS = [
-  "mandatory-zone-untested",
-  "unrequested-test-file",
-  "protected-removed",
-  "stale-protected-entry",
-  "stale-satisfied-by"
-];
-function translate(glob) {
-  let out = "";
-  for (let i = 0; i < glob.length; i++) {
-    const c = glob[i];
-    if (c === "*") {
-      if (glob[i + 1] === "*") {
-        if (glob[i + 2] === "/") {
-          out += "(?:.*/)?";
-          i += 2;
-        } else {
-          out += ".*";
-          i += 1;
-        }
-      } else {
-        out += "[^/]*";
-      }
+function toPosix(p) {
+  return p.split(import_node_path20.sep).join("/");
+}
+function listCandidatePaths(cwd, exec = import_node_child_process11.execFileSync) {
+  try {
+    const out = exec("git", ["ls-files", "-z", "-c", "-o", "--exclude-standard"], {
+      cwd,
+      encoding: "utf8",
+      maxBuffer: 64 * 1024 * 1024
+    });
+    return out.split("\0").filter(Boolean).map(toPosix);
+  } catch {
+    return [];
+  }
+}
+function rebuildRepoIndex(cwd, repoSlug2) {
+  const candidates = listCandidatePaths(cwd).filter(isIndexablePath);
+  const ignored = defaultIsIgnored(cwd, candidates);
+  const readmeHints = loadReadmeHints(cwd, candidates.filter((p) => !ignored.has(p)));
+  const entries = [];
+  for (const rel of candidates) {
+    if (ignored.has(rel)) continue;
+    if (isHardDeniedPath(rel)) continue;
+    const abs = (0, import_node_path20.join)(cwd, ...rel.split("/"));
+    if (!(0, import_node_fs22.existsSync)(abs)) continue;
+    let text;
+    try {
+      text = (0, import_node_fs22.readFileSync)(abs, "utf8");
+    } catch {
       continue;
     }
-    if (c === "{") {
-      const close = glob.indexOf("}", i);
-      if (close !== -1) {
-        const alts = glob.slice(i + 1, close).split(",").map((a) => translate(a));
-        out += `(?:${alts.join("|")})`;
-        i = close;
-        continue;
-      }
-    }
-    out += /[.+?^${}()|[\]\\]/.test(c) ? `\\${c}` : c;
+    if (text.length > 15e5) continue;
+    const hash = (0, import_node_crypto4.createHash)("sha256").update(text).digest("hex").slice(0, 16);
+    const symbols = extractSymbols(text);
+    const docBlurb = extractModuleBlurb(text);
+    const top = rel.includes("/") ? rel.split("/")[0] : "";
+    const hint = docBlurb ?? (top ? readmeHints.get(top) : void 0) ?? readmeHints.get("");
+    entries.push({
+      path: rel,
+      hash,
+      symbols,
+      ...hint ? { blurb: hint.slice(0, BLURB_CAP) } : {}
+    });
   }
-  return out;
+  entries.sort((a, b) => a.path.localeCompare(b.path));
+  const projection = {
+    schema: REPO_INDEX_SCHEMA,
+    repo: repoSlug2,
+    builtAt: (/* @__PURE__ */ new Date()).toISOString(),
+    entries
+  };
+  const store = repoIndexStorePath(cwd);
+  (0, import_node_fs22.mkdirSync)((0, import_node_path20.dirname)(store), { recursive: true });
+  (0, import_node_fs22.writeFileSync)(store, `${JSON.stringify(projection, null, 2)}
+`, "utf8");
+  return projection;
 }
-function globToRegExp(glob) {
-  return new RegExp(`^${translate(glob)}$`);
+function loadRepoIndex(cwd) {
+  const store = repoIndexStorePath(cwd);
+  if (!(0, import_node_fs22.existsSync)(store)) return null;
+  try {
+    const raw = JSON.parse((0, import_node_fs22.readFileSync)(store, "utf8"));
+    if (raw?.schema !== REPO_INDEX_SCHEMA || !Array.isArray(raw.entries)) return null;
+    return raw;
+  } catch {
+    return null;
+  }
 }
-function isTestPath(path2) {
-  return TEST_RE.test(path2) || PY_TEST_RE.test(path2);
+function repoIndexStatus(cwd) {
+  const path2 = repoIndexStorePath(cwd);
+  const idx = loadRepoIndex(cwd);
+  if (!idx) return { present: false, path: path2 };
+  const symbolCount = idx.entries.reduce((n, e) => n + e.symbols.length, 0);
+  return {
+    present: true,
+    path: path2,
+    schema: idx.schema,
+    repo: idx.repo,
+    builtAt: idx.builtAt,
+    fileCount: idx.entries.length,
+    symbolCount
+  };
 }
-function loadPolicy(root, readFile9 = readFileOrNull2) {
-  const raw = readFile9((0, import_node_path21.join)(root, POLICY_FILE));
-  if (raw == null) return { mandatory: [], declared: false };
-  try {
-    return { ...JSON.parse(raw), declared: true };
-  } catch (error) {
-    throw new Error(`${POLICY_FILE} is not valid JSON: ${error.message}`);
+function searchRepoIndex(idx, query, limit = 20) {
+  const q = query.trim().toLowerCase();
+  if (!q) return [];
+  const hits = [];
+  for (const e of idx.entries) {
+    const pathLower = e.path.toLowerCase();
+    if (pathLower.includes(q) || pathLower.endsWith(`/${q}`) || pathLower === q) {
+      hits.push({
+        repo: idx.repo,
+        path: e.path,
+        kind: "path",
+        why: pathLower === q || pathLower.endsWith(`/${q}`) ? "exact path segment" : "path substring",
+        score: pathLower === q ? 1 : pathLower.endsWith(`/${q}`) ? 0.95 : 0.7
+      });
+    }
+    for (const sym of e.symbols) {
+      const sl = sym.toLowerCase();
+      if (sl === q || sl.startsWith(q)) {
+        hits.push({
+          repo: idx.repo,
+          path: e.path,
+          kind: "symbol",
+          symbol: sym,
+          why: sl === q ? "exact symbol" : "symbol prefix",
+          score: sl === q ? 1 : 0.85
+        });
+      }
+    }
+  }
+  hits.sort((a, b) => b.score - a.score || a.path.localeCompare(b.path));
+  const seen = /* @__PURE__ */ new Set();
+  const out = [];
+  for (const h of hits) {
+    const key = `${h.kind}:${h.path}:${h.symbol ?? ""}`;
+    if (seen.has(key)) continue;
+    seen.add(key);
+    out.push(h);
+    if (out.length >= limit) break;
   }
+  return out;
 }
-function readFileOrNull2(path2) {
+function inferRepoSlug(cwd, exec = import_node_child_process11.execFileSync) {
   try {
-    return (0, import_node_fs23.readFileSync)(path2, "utf8");
+    const url = String(exec("git", ["remote", "get-url", "origin"], { cwd, encoding: "utf8" })).trim();
+    const m = /[:/]([^/]+\/[^/]+?)(?:\.git)?$/.exec(url);
+    if (m?.[1]) return m[1];
   } catch {
-    return null;
   }
+  return (0, import_node_path20.basename)(cwd) || "local";
 }
-function removedPaths(changed) {
-  return new Set(
-    changed.map((f) => f.status === "D" ? f.path : f.status === "R" || f.status === "C" ? f.from : void 0).filter((p) => typeof p === "string")
-  );
-}
-function classify(changed, policy, present = () => false) {
-  const matchers = (policy.mandatory ?? []).map((m) => ({ ...m, re: globToRegExp(m.glob) }));
-  const mandatoryHits = changed.filter((f) => matchers.some((m) => m.re.test(f.path)));
-  const testChanges = changed.filter((f) => isTestPath(f.path));
-  const addedTests = testChanges.filter((f) => f.status === "A");
-  const removed = removedPaths(changed);
-  const discharged = (m) => (m.satisfiedBy?.length ?? 0) > 0 && m.satisfiedBy.every((p) => present(p) && !removed.has(p));
-  const untestedHits = changed.filter((f) => matchers.some((m) => m.re.test(f.path) && !discharged(m)));
-  const protectedBy = new Map((policy.protected ?? []).map((p) => [p.path, p.why ?? ""]));
-  for (const m of policy.mandatory ?? []) {
-    for (const p of m.satisfiedBy ?? []) {
-      if (!protectedBy.has(p)) protectedBy.set(p, `the standing coverage \`${m.glob}\` is discharged by. Removing it silently empties that glob.`);
+
+// src/repo-index-cloud-client.ts
+var RETRY_ATTEMPTS2 = 3;
+async function publishRepoIndexCloud(payload, deps) {
+  if (!deps.baseUrl) return { ok: false, error: "Hub API URL not configured" };
+  const token = await deps.token();
+  if (!token) return { ok: false, error: "no Hub session token (run `gh auth login`)" };
+  try {
+    const res = await fetchWithRetry(
+      deps.fetch ?? fetch,
+      `${deps.baseUrl.replace(/\/$/, "")}/repo-index/publish`,
+      {
+        method: "POST",
+        headers: {
+          ...clientVersionHeaders(),
+          Authorization: `Bearer ${token}`,
+          "content-type": "application/json"
+        },
+        body: JSON.stringify(payload)
+      },
+      {
+        attempts: RETRY_ATTEMPTS2,
+        // Embed publish can take longer than a registry read.
+        timeoutMs: payload.embed ? 12e4 : deps.timeoutMs ?? REGISTRY_FETCH_TIMEOUT_MS,
+        sleep: deps.retrySleep
+      }
+    );
+    if (res.status === 426) return { ok: false, error: upgradeRequiredError(res, await res.json().catch(() => null)), status: 426 };
+    const body = await res.json().catch(() => ({}));
+    if (!res.ok) {
+      return { ok: false, error: typeof body.error === "string" ? body.error : `publish HTTP ${res.status}`, status: res.status };
     }
+    return { ok: true, body };
+  } catch (e) {
+    return { ok: false, error: e.message };
   }
-  const removedProtected = [...removed].filter((p) => protectedBy.has(p)).map((p) => ({ path: p, why: protectedBy.get(p) ?? "" }));
-  return { mandatoryHits, untestedHits, testChanges, addedTests, removedProtected };
 }
-function unresolvedProtectedEntries(policy, root, exists = (path2) => (0, import_node_fs23.existsSync)(path2)) {
-  return (policy.protected ?? []).map((p) => p.path).filter((p) => !exists((0, import_node_path21.join)(root, p)));
-}
-function unresolvedSatisfiers(policy, root, exists = (path2) => (0, import_node_fs23.existsSync)(path2)) {
-  const declared = (policy.mandatory ?? []).flatMap((m) => m.satisfiedBy ?? []);
-  return [...new Set(declared)].filter((p) => !exists((0, import_node_path21.join)(root, p)));
+async function searchRepoIndexCloud(query, opts, deps) {
+  if (!deps.baseUrl) return { ok: false, error: "Hub API URL not configured" };
+  const token = await deps.token();
+  if (!token) return { ok: false, error: "no Hub session token (run `gh auth login`)" };
+  const params = new URLSearchParams({
+    q: query,
+    mode: opts.mode ?? "hybrid",
+    limit: String(opts.limit ?? 20)
+  });
+  if (opts.repo) params.set("repo", opts.repo);
+  try {
+    const res = await fetchWithRetry(
+      deps.fetch ?? fetch,
+      `${deps.baseUrl.replace(/\/$/, "")}/repo-index/search?${params}`,
+      { method: "GET", headers: { ...clientVersionHeaders(), Authorization: `Bearer ${token}` } },
+      { attempts: RETRY_ATTEMPTS2, timeoutMs: opts.mode === "semantic" || opts.mode === "hybrid" ? 6e4 : deps.timeoutMs ?? REGISTRY_FETCH_TIMEOUT_MS, sleep: deps.retrySleep }
+    );
+    if (res.status === 426) return { ok: false, error: upgradeRequiredError(res, await res.json().catch(() => null)), status: 426 };
+    const body = await res.json().catch(() => ({}));
+    if (!res.ok) return { ok: false, error: body.error ?? `search HTTP ${res.status}`, status: res.status };
+    return {
+      ok: true,
+      query: body.query ?? query,
+      mode: body.mode ?? opts.mode ?? "hybrid",
+      hits: Array.isArray(body.hits) ? body.hits : [],
+      note: body.note
+    };
+  } catch (e) {
+    return { ok: false, error: e.message };
+  }
+}
+function isRepoIndexStatusError(st) {
+  return typeof st === "object" && st !== null && st.ok === false && typeof st.error === "string" && typeof st.code === "string";
+}
+function explainRepoIndexStatusError(err) {
+  switch (err.code) {
+    case "deploy-lag":
+      return "repo-index status: the Hub API did not recognize /repo-index/status (HTTP 404). The deployed Hub predates the estate index routes \u2014 not an auth error. Ship a Hub release from development that includes /repo-index/*, then run `repo-index-reconcile` (or `mmi-cli repo-index sync-estate`) so projections exist.";
+    case "auth":
+      return `repo-index status: ${err.error} \u2014 run \`gh auth login\` / refresh the Hub session.`;
+    case "config":
+      return `repo-index status: ${err.error}`;
+    default:
+      return `repo-index status: ${err.error}`;
+  }
+}
+async function statusRepoIndexCloud(repo, deps) {
+  if (!deps.baseUrl) return { ok: false, error: "Hub API URL not configured", code: "config" };
+  const token = await deps.token();
+  if (!token) return { ok: false, error: "no Hub session token (run `gh auth login`)", code: "auth" };
+  const params = new URLSearchParams();
+  if (repo) params.set("repo", repo);
+  const q = params.toString();
+  try {
+    const res = await fetchWithRetry(
+      deps.fetch ?? fetch,
+      `${deps.baseUrl.replace(/\/$/, "")}/repo-index/status${q ? `?${q}` : ""}`,
+      { method: "GET", headers: { ...clientVersionHeaders(), Authorization: `Bearer ${token}` } },
+      { attempts: RETRY_ATTEMPTS2, timeoutMs: deps.timeoutMs ?? REGISTRY_FETCH_TIMEOUT_MS, sleep: deps.retrySleep }
+    );
+    if (res.status === 401 || res.status === 403) {
+      return { ok: false, error: `status HTTP ${res.status}`, code: "auth", status: res.status };
+    }
+    if (res.status === 404) {
+      return {
+        ok: false,
+        error: "the Hub API did not recognize /repo-index/status (HTTP 404) \u2014 deployed Hub predates estate index",
+        code: "deploy-lag",
+        status: 404
+      };
+    }
+    if (!res.ok) return { ok: false, error: `status HTTP ${res.status}`, code: "http", status: res.status };
+    return await res.json();
+  } catch (e) {
+    return { ok: false, error: e.message, code: "network" };
+  }
+}
+async function gcRepoIndexCloud(deps) {
+  if (!deps.baseUrl) return { ok: false, error: "Hub API URL not configured" };
+  const token = await deps.token();
+  if (!token) return { ok: false, error: "no Hub session token (run `gh auth login`)" };
+  try {
+    const res = await fetchWithRetry(
+      deps.fetch ?? fetch,
+      `${deps.baseUrl.replace(/\/$/, "")}/repo-index/gc`,
+      {
+        method: "POST",
+        headers: { ...clientVersionHeaders(), Authorization: `Bearer ${token}`, "content-type": "application/json" },
+        body: "{}"
+      },
+      { attempts: RETRY_ATTEMPTS2, timeoutMs: deps.timeoutMs ?? REGISTRY_FETCH_TIMEOUT_MS, sleep: deps.retrySleep }
+    );
+    const body = await res.json().catch(() => ({}));
+    if (!res.ok) return { ok: false, error: body.error ?? `gc HTTP ${res.status}` };
+    return { ok: true, removed: body.removed ?? [] };
+  } catch (e) {
+    return { ok: false, error: e.message };
+  }
+}
+
+// src/repo-index-sync.ts
+var import_node_fs23 = require("node:fs");
+var import_node_os9 = require("node:os");
+var import_node_path21 = require("node:path");
+var import_node_child_process12 = require("node:child_process");
+var MAX_EMBED_BACKFILL_ROUNDS = 40;
+function normalizeRepo(raw) {
+  const t = raw.trim().replace(/\.git$/, "");
+  if (t.includes("/")) return t;
+  return `mutmutco/${t}`;
+}
+function rosterRepos(projects) {
+  const set = /* @__PURE__ */ new Set();
+  for (const p of projects) {
+    if (p.class === "content") continue;
+    for (const r of p.repos ?? []) set.add(normalizeRepo(r));
+  }
+  return [...set].sort((a, b) => a.localeCompare(b));
+}
+function shallowClone(repo, dest, token) {
+  (0, import_node_child_process12.execFileSync)(
+    "git",
+    ["-c", `http.extraHeader=Authorization: Bearer ${token}`, "clone", "--depth", "1", "--single-branch", `https://github.com/${repo}.git`, dest],
+    { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] }
+  );
+}
+async function syncEstateRepoIndex(opts) {
+  const projects = await fetchProjectsList(opts.deps);
+  if (!projects) {
+    return { ok: false, published: [], failed: [{ repo: "*", error: "could not read /projects/list" }], skipped: [] };
+  }
+  let repos = rosterRepos(projects);
+  if (opts.repo) {
+    const want = normalizeRepo(opts.repo);
+    repos = repos.filter((r) => r.toLowerCase() === want.toLowerCase());
+    if (repos.length === 0) {
+      return { ok: false, published: [], failed: [{ repo: want, error: "not on registry code roster" }], skipped: [] };
+    }
+  }
+  const published = [];
+  const failed = [];
+  const skipped = [];
+  for (const repo of repos) {
+    const dir = (0, import_node_fs23.mkdtempSync)((0, import_node_path21.join)((0, import_node_os9.tmpdir)(), "mmi-repo-index-"));
+    try {
+      shallowClone(repo, dir, opts.githubToken);
+      const built = rebuildRepoIndex(dir, repo);
+      let pub = await publishRepoIndexCloud(
+        {
+          repo,
+          builtAt: built.builtAt,
+          entries: built.entries,
+          embed: opts.embed === true
+        },
+        opts.deps
+      );
+      if (!pub.ok) {
+        failed.push({ repo, error: pub.error });
+        continue;
+      }
+      let rounds = 1;
+      while (opts.embed === true && pub.ok && pub.body.embTruncated === true && rounds < MAX_EMBED_BACKFILL_ROUNDS) {
+        pub = await publishRepoIndexCloud(
+          {
+            repo,
+            builtAt: built.builtAt,
+            entries: built.entries,
+            embed: true
+          },
+          opts.deps
+        );
+        if (!pub.ok) {
+          failed.push({ repo, error: pub.error });
+          break;
+        }
+        rounds++;
+      }
+      if (!pub.ok) continue;
+      const fileCount = Number(pub.body.fileCount ?? built.entries.length);
+      const embCount = typeof pub.body.embCount === "number" ? pub.body.embCount : void 0;
+      const embGap = typeof pub.body.embGap === "number" ? pub.body.embGap : typeof embCount === "number" ? Math.max(0, fileCount - embCount) : void 0;
+      published.push({
+        repo,
+        fileCount,
+        embCount,
+        embGap,
+        embTruncated: pub.body.embTruncated === true,
+        embedRounds: opts.embed ? rounds : void 0
+      });
+    } catch (e) {
+      failed.push({ repo, error: e.message });
+    } finally {
+      try {
+        (0, import_node_fs23.rmSync)(dir, { recursive: true, force: true });
+      } catch {
+      }
+    }
+  }
+  return { ok: failed.length === 0, published, failed, skipped };
+}
+
+// src/repo-index-health.ts
+var import_node_fs24 = require("node:fs");
+var import_node_path22 = require("node:path");
+function defaultGoldenPath(repoRoot2) {
+  return (0, import_node_path22.join)(repoRoot2, "cli", "testdata", "repo-index-golden-queries.json");
+}
+function loadGoldenSuite(path2) {
+  const raw = JSON.parse((0, import_node_fs24.readFileSync)(path2, "utf8"));
+  if (!raw || raw.schema !== 1 || !Array.isArray(raw.queries)) {
+    throw new Error(`invalid golden suite at ${path2}`);
+  }
+  return raw;
+}
+function evaluateQueryHits(query, hits) {
+  if (!hits.length) {
+    return { ok: false, code: "empty-hits", detail: `${query.id}: no hits for ${JSON.stringify(query.q)}` };
+  }
+  const top = hits[0];
+  const minScore = query.expect.minScore ?? 0;
+  if (typeof top.score === "number" && top.score < minScore) {
+    return {
+      ok: false,
+      code: "low-score",
+      detail: `${query.id}: top score ${top.score} < ${minScore}`
+    };
+  }
+  if (query.expect.topRepos?.length) {
+    const repo = String(top.repo ?? "");
+    if (!query.expect.topRepos.some((r) => r.toLowerCase() === repo.toLowerCase())) {
+      return {
+        ok: false,
+        code: "wrong-repo",
+        detail: `${query.id}: top repo ${JSON.stringify(repo)} not in ${JSON.stringify(query.expect.topRepos)}`
+      };
+    }
+  }
+  if (query.expect.topPaths?.length) {
+    const path2 = String(top.path ?? "");
+    if (!query.expect.topPaths.some((p) => path2 === p || path2.endsWith(p) || path2.includes(p))) {
+      return {
+        ok: false,
+        code: "wrong-path",
+        detail: `${query.id}: top path ${JSON.stringify(path2)} not in ${JSON.stringify(query.expect.topPaths)}`
+      };
+    }
+  }
+  return { ok: true, code: "ok", detail: `${query.id}: top hit accepted` };
+}
+function evaluateCloudStatus(status, golden) {
+  const findings = [];
+  const count = typeof status.count === "number" ? status.count : Array.isArray(status.repos) ? status.repos.length : null;
+  if (count === 0 || Array.isArray(status.repos) && status.repos.length === 0 && status.present !== true) {
+    findings.push({ ok: false, code: "projections-empty", detail: "cloud repo-index has zero projections" });
+  }
+  const repos = [];
+  if (Array.isArray(status.repos)) {
+    for (const r of status.repos) {
+      if (r && typeof r === "object") repos.push(r);
+    }
+  } else if (status.present === true && typeof status.repo === "string") {
+    repos.push(status);
+  }
+  const stale = repos.filter((r) => r.stale === true);
+  if (stale.length) {
+    findings.push({
+      ok: false,
+      code: "stale-projections",
+      detail: `${stale.length} stale projection(s) (threshold ${golden.staleThresholdHours}h): ${stale.slice(0, 5).map((r) => r.repo).join(", ")}`
+    });
+  }
+  const hub = repos.find((r) => r.repo?.toLowerCase() === golden.hubRepo.toLowerCase()) ?? (typeof status.repo === "string" && status.repo.toLowerCase() === golden.hubRepo.toLowerCase() ? status : void 0);
+  if (!hub || hub.present === false) {
+    findings.push({ ok: false, code: "hub-missing", detail: `${golden.hubRepo} projection missing` });
+  } else {
+    const fileCount = Number(hub.fileCount ?? 0);
+    const embCount = Number(hub.embCount ?? 0);
+    if (fileCount <= 0) {
+      findings.push({ ok: false, code: "hub-empty", detail: `${golden.hubRepo} has fileCount=${fileCount}` });
+    }
+    const denom = Math.min(fileCount, golden.maxSyncEmbeds);
+    const coverage = denom > 0 ? embCount / denom : 0;
+    if (fileCount > 0 && coverage < golden.hubEmbMinCoverage) {
+      findings.push({
+        ok: false,
+        code: "hub-emb-gap",
+        detail: `${golden.hubRepo} embCoverage=${coverage.toFixed(2)} (emb=${embCount} files=${fileCount} cap=${golden.maxSyncEmbeds}) < ${golden.hubEmbMinCoverage}`
+      });
+    }
+  }
+  if (!findings.length) {
+    findings.push({ ok: true, code: "status-ok", detail: `status healthy (${repos.length || count || 0} repo projection(s))` });
+  }
+  return findings;
+}
+async function runRepoIndexHealth(opts) {
+  const findings = [];
+  if (opts.live) {
+    const st = await opts.live.status();
+    if (st.ok === false && typeof st.error === "string") {
+      findings.push({ ok: false, code: "status-error", detail: st.error });
+    } else {
+      findings.push(...evaluateCloudStatus(st, opts.golden));
+    }
+    for (const q of opts.golden.queries) {
+      const res = await opts.live.search(q.q, q.mode);
+      if (!res.ok) {
+        const semantic503 = q.mode === "semantic" && (res.status === 503 || /semantic unavailable|503/i.test(res.error));
+        findings.push({
+          ok: false,
+          code: semantic503 ? "semantic-503" : "search-error",
+          detail: `${q.id}: ${res.error}`
+        });
+        continue;
+      }
+      findings.push(evaluateQueryHits(q, res.hits));
+    }
+  } else if (opts.fixtures) {
+    for (const q of opts.golden.queries) {
+      const fx = opts.fixtures[q.id];
+      if (!fx) {
+        findings.push({ ok: false, code: "fixture-missing", detail: `${q.id}: no fixture` });
+        continue;
+      }
+      if (fx.error) {
+        const semantic503 = q.mode === "semantic" && (fx.status === 503 || /semantic unavailable|503/i.test(fx.error));
+        findings.push({
+          ok: false,
+          code: semantic503 ? "semantic-503" : "search-error",
+          detail: `${q.id}: ${fx.error}`
+        });
+        continue;
+      }
+      findings.push(evaluateQueryHits(q, fx.hits ?? []));
+    }
+  } else {
+    for (const q of opts.golden.queries) {
+      if (!q.id || !q.q || !q.mode) {
+        findings.push({ ok: false, code: "golden-invalid", detail: `query missing id/q/mode` });
+      } else {
+        findings.push({ ok: true, code: "golden-ok", detail: `${q.id}: shape ok` });
+      }
+    }
+  }
+  return { ok: findings.every((f) => f.ok), findings };
+}
+
+// src/spawn-policy-core.ts
+var import_node_child_process13 = require("node:child_process");
+var import_node_fs25 = require("node:fs");
+var import_node_path23 = require("node:path");
+var SPAWNERS = ["spawn", "spawnSync", "exec", "execSync", "execFile", "execFileSync"];
+var CALL_SOURCE = String.raw`(^|[^.\w$])(${SPAWNERS.join("|")})\s*\(`;
+var SOURCE_EXT = /\.(ts|mts|cts|js|mjs|cjs)$/;
+var EXCLUDED = [
+  /(^|\/)node_modules\//,
+  /(^|\/)(dist|build|coverage)\//,
+  /(^|\/)(test|tests|__tests__|fixtures|__fixtures__)\//,
+  /\.(test|spec)\.[cm]?[jt]s$/,
+  /\.d\.[cm]?ts$/
+];
+function stripComments(src) {
+  return src.replace(/\/\*[\s\S]*?\*\//g, (m) => m.replace(/[^\n]/g, " ")).replace(/(^|[^:])\/\/[^\n]*/g, (m, p) => p + " ".repeat(m.length - p.length));
+}
+function callArgs(src, open2) {
+  let depth = 0;
+  for (let i = open2; i < src.length; i++) {
+    const c = src[i];
+    if (c === "(") depth++;
+    else if (c === ")") {
+      depth--;
+      if (depth === 0) return src.slice(open2, i + 1);
+    }
+  }
+  return "";
+}
+function findViolationsInSource(raw) {
+  if (!/from\s+["']node:child_process["']/.test(raw)) return [];
+  const importBlock = /import\s*(?:type\s*)?\{([^}]*)\}\s*from\s+["']node:child_process["']/.exec(raw);
+  const imported = new Set(
+    (importBlock?.[1] ?? "").split(",").map((s) => s.trim().split(/\s+as\s+/)[0].trim()).filter(Boolean)
+  );
+  if (imported.size === 0) return [];
+  const rawLines = raw.split("\n");
+  const src = stripComments(raw);
+  const call = new RegExp(CALL_SOURCE, "g");
+  const found = [];
+  let m;
+  while (m = call.exec(src)) {
+    const callee = m[2];
+    if (!imported.has(callee)) continue;
+    const open2 = m.index + m[0].length - 1;
+    const args = callArgs(src, open2);
+    if (!args) continue;
+    if (args.includes("windowsHide")) continue;
+    const line = src.slice(0, m.index + m[1].length).split("\n").length;
+    if (/windows-hide-exempt:/.test(rawLines[line - 2] ?? "")) continue;
+    if (/\.{3}\s*\w+/.test(args)) continue;
+    if (/\b(opts|options|spawnOptions)\b/.test(args)) continue;
+    const identifiers = new Set(args.match(/\b[A-Za-z_$][\w$]*\b/g) ?? []);
+    let satisfied = false;
+    for (const id of identifiers) {
+      if (SPAWNERS.includes(id)) continue;
+      const decl = new RegExp(String.raw`\b(?:const|let|var)\s+${id}\b[^;]*`, "s").exec(src);
+      if (decl && decl[0].includes("windowsHide")) {
+        satisfied = true;
+        break;
+      }
+      if (new RegExp(String.raw`\b${id}\s*:\s*\{[^}]*windowsHide`, "s").test(src)) {
+        satisfied = true;
+        break;
+      }
+    }
+    if (satisfied) continue;
+    found.push({ line, callee });
+  }
+  return found;
+}
+function policedFiles(root) {
+  const r = (0, import_node_child_process13.spawnSync)("git", ["ls-files", "-z", "--cached", "--others", "--exclude-standard"], {
+    cwd: root,
+    encoding: "utf8",
+    windowsHide: true,
+    maxBuffer: 32 * 1024 * 1024
+  });
+  if (r.status !== 0) {
+    throw new Error(`spawn policy: git ls-files failed: ${(r.stderr || "").trim() || `exit ${r.status}`}`);
+  }
+  return (r.stdout ?? "").split("\0").filter(Boolean).filter((f) => SOURCE_EXT.test(f)).filter((f) => !EXCLUDED.some((re) => re.test(f)));
+}
+function runSpawnPolicy(root) {
+  const files = policedFiles(root);
+  const findings = [];
+  for (const file of files) {
+    let raw;
+    try {
+      raw = (0, import_node_fs25.readFileSync)((0, import_node_path23.join)(root, file), "utf8");
+    } catch {
+      continue;
+    }
+    for (const v of findViolationsInSource(raw)) {
+      findings.push({
+        file,
+        line: v.line,
+        callee: v.callee,
+        detail: `${file}:${v.line} ${v.callee}(...) has no windowsHide`
+      });
+    }
+  }
+  return { ok: findings.length === 0, scannedCount: files.length, findings };
+}
+
+// src/test-policy-core.ts
+var import_node_child_process14 = require("node:child_process");
+var import_node_fs26 = require("node:fs");
+var import_node_path24 = require("node:path");
+var POLICY_FILE = "test-policy.json";
+var TEST_RE = /\.(?:test|spec)\.[cm]?[jt]sx?$/;
+var PY_TEST_RE = /(?:^|\/)test_[^/]*\.py$|_test\.py$/;
+var TRAILER_KEY = "Test-Policy-Override";
+var OVERRIDE_RE = /^Test-Policy-Override:\s*(.+)$/im;
+var REC = "";
+var FLD = "";
+var WAIVABLE_KINDS = [
+  "mandatory-zone-untested",
+  "unrequested-test-file",
+  "protected-removed",
+  "stale-protected-entry",
+  "stale-satisfied-by"
+];
+function translate(glob) {
+  let out = "";
+  for (let i = 0; i < glob.length; i++) {
+    const c = glob[i];
+    if (c === "*") {
+      if (glob[i + 1] === "*") {
+        if (glob[i + 2] === "/") {
+          out += "(?:.*/)?";
+          i += 2;
+        } else {
+          out += ".*";
+          i += 1;
+        }
+      } else {
+        out += "[^/]*";
+      }
+      continue;
+    }
+    if (c === "{") {
+      const close = glob.indexOf("}", i);
+      if (close !== -1) {
+        const alts = glob.slice(i + 1, close).split(",").map((a) => translate(a));
+        out += `(?:${alts.join("|")})`;
+        i = close;
+        continue;
+      }
+    }
+    out += /[.+?^${}()|[\]\\]/.test(c) ? `\\${c}` : c;
+  }
+  return out;
+}
+function globToRegExp(glob) {
+  return new RegExp(`^${translate(glob)}$`);
+}
+function isTestPath(path2) {
+  return TEST_RE.test(path2) || PY_TEST_RE.test(path2);
+}
+function loadPolicy(root, readFile9 = readFileOrNull2) {
+  const raw = readFile9((0, import_node_path24.join)(root, POLICY_FILE));
+  if (raw == null) return { mandatory: [], declared: false };
+  try {
+    return { ...JSON.parse(raw), declared: true };
+  } catch (error) {
+    throw new Error(`${POLICY_FILE} is not valid JSON: ${error.message}`);
+  }
+}
+function readFileOrNull2(path2) {
+  try {
+    return (0, import_node_fs26.readFileSync)(path2, "utf8");
+  } catch {
+    return null;
+  }
+}
+function removedPaths(changed) {
+  return new Set(
+    changed.map((f) => f.status === "D" ? f.path : f.status === "R" || f.status === "C" ? f.from : void 0).filter((p) => typeof p === "string")
+  );
+}
+function classify(changed, policy, present = () => false) {
+  const matchers = (policy.mandatory ?? []).map((m) => ({ ...m, re: globToRegExp(m.glob) }));
+  const mandatoryHits = changed.filter((f) => matchers.some((m) => m.re.test(f.path)));
+  const testChanges = changed.filter((f) => isTestPath(f.path));
+  const addedTests = testChanges.filter((f) => f.status === "A");
+  const removed = removedPaths(changed);
+  const discharged = (m) => (m.satisfiedBy?.length ?? 0) > 0 && m.satisfiedBy.every((p) => present(p) && !removed.has(p));
+  const untestedHits = changed.filter((f) => matchers.some((m) => m.re.test(f.path) && !discharged(m)));
+  const protectedBy = new Map((policy.protected ?? []).map((p) => [p.path, p.why ?? ""]));
+  for (const m of policy.mandatory ?? []) {
+    for (const p of m.satisfiedBy ?? []) {
+      if (!protectedBy.has(p)) protectedBy.set(p, `the standing coverage \`${m.glob}\` is discharged by. Removing it silently empties that glob.`);
+    }
+  }
+  const removedProtected = [...removed].filter((p) => protectedBy.has(p)).map((p) => ({ path: p, why: protectedBy.get(p) ?? "" }));
+  return { mandatoryHits, untestedHits, testChanges, addedTests, removedProtected };
+}
+function unresolvedProtectedEntries(policy, root, exists = (path2) => (0, import_node_fs26.existsSync)(path2)) {
+  return (policy.protected ?? []).map((p) => p.path).filter((p) => !exists((0, import_node_path24.join)(root, p)));
+}
+function unresolvedSatisfiers(policy, root, exists = (path2) => (0, import_node_fs26.existsSync)(path2)) {
+  const declared = (policy.mandatory ?? []).flatMap((m) => m.satisfiedBy ?? []);
+  return [...new Set(declared)].filter((p) => !exists((0, import_node_path24.join)(root, p)));
 }
 function evaluate(changed, policy, present = () => false) {
   const { mandatoryHits, untestedHits, testChanges, addedTests, removedProtected } = classify(changed, policy, present);
@@ -19518,14 +20193,14 @@ function evaluate(changed, policy, present = () => false) {
   return findings;
 }
 function git(args, cwd) {
-  return (0, import_node_child_process12.execFileSync)("git", args, { windowsHide: true, cwd, encoding: "utf8", maxBuffer: 32 * 1024 * 1024 });
+  return (0, import_node_child_process14.execFileSync)("git", args, { windowsHide: true, cwd, encoding: "utf8", maxBuffer: 32 * 1024 * 1024 });
 }
 var COAUTHOR_KEY = "Co-authored-by";
 var GH_MESSAGE_SEPARATOR = /^-{5,}$/;
 var LIFTED_KEYS = new RegExp(`^(?:${TRAILER_KEY}|${COAUTHOR_KEY}):`, "i");
 function parseTrailers(message, cwd) {
   try {
-    return (0, import_node_child_process12.execFileSync)("git", ["interpret-trailers", "--parse", "--unfold"], {
+    return (0, import_node_child_process14.execFileSync)("git", ["interpret-trailers", "--parse", "--unfold"], {
       windowsHide: true,
       cwd,
       input: message,
@@ -19667,13 +20342,13 @@ function changedFilesSince(base, cwd) {
 }
 function runTestPolicy(root, deps = {}) {
   const policy = deps.policy ?? loadPolicy(root);
-  const exists = deps.exists ?? ((path2) => (0, import_node_fs23.existsSync)(path2));
+  const exists = deps.exists ?? ((path2) => (0, import_node_fs26.existsSync)(path2));
   const counts = { mandatoryCount: (policy.mandatory ?? []).length, protectedCount: (policy.protected ?? []).length };
   const base = deps.changed ? "(injected)" : resolveBase(root, deps.base);
   const refusal = deps.changed ? null : untrustworthyRange(root, base);
   const changed = deps.changed ?? (refusal ? [] : changedFilesSince(base, root));
   const lookup = deps.override !== void 0 ? { override: deps.override, refusals: [] } : !deps.changed && !refusal ? readOverride(base, root) : { override: null, refusals: [] };
-  const present = (path2) => exists((0, import_node_path21.join)(root, path2));
+  const present = (path2) => exists((0, import_node_path24.join)(root, path2));
   const removedByThisDiff = removedPaths(changed);
   const staleFindings = [];
   const unresolved = unresolvedProtectedEntries(policy, root, exists).filter((p) => !removedByThisDiff.has(p));
@@ -19829,8 +20504,8 @@ function docsAuditStatus(fetch2, opts) {
 }
 
 // src/project-info-sync.ts
-var import_node_fs24 = require("node:fs");
-var import_node_path22 = require("node:path");
+var import_node_fs27 = require("node:fs");
+var import_node_path25 = require("node:path");
 var UPDATE_PROJECT_INFO = `mutation($projectId: ID!, $shortDescription: String!, $readme: String!) {
   updateProjectV2(input: { projectId: $projectId, shortDescription: $shortDescription, readme: $readme }) {
     projectV2 { id }
@@ -19875,14 +20550,14 @@ function sharedName(entries, fallback) {
 }
 function buildProjectInfoSyncPlan(targetRepo2, project2, projects, repoRoot2) {
   if (!project2.projectId) throw new Error(`org project sync-info: ${targetRepo2} registry META has no projectId`);
-  const readmePath = (0, import_node_path22.join)(repoRoot2, "README.md");
-  if (!(0, import_node_fs24.existsSync)(readmePath)) throw new Error(`org project sync-info: ${targetRepo2} has no README.md`);
+  const readmePath = (0, import_node_path25.join)(repoRoot2, "README.md");
+  if (!(0, import_node_fs27.existsSync)(readmePath)) throw new Error(`org project sync-info: ${targetRepo2} has no README.md`);
   const entries = entriesFor(project2, projects);
   const memberRepos = [...new Set(entries.flatMap((entry) => entry.repos ?? []))].filter((repo) => /^[^/]+\/[^/]+$/.test(repo)).sort((a, b) => a.localeCompare(b));
   const projectName = sharedName(entries, project2.name?.trim() || targetRepo2.split("/").pop() || targetRepo2);
   if (!memberRepos.length) throw new Error(`org project sync-info: project ${projectName} has no registered member repos`);
   const entryNames = entries.map((entry) => entry.name?.trim()).filter((name) => Boolean(name));
-  const shortDescription = memberRepos.length === 1 ? shortDescriptionFromReadme((0, import_node_fs24.readFileSync)(readmePath, "utf8")) : `Shared work across ${new Intl.ListFormat("en", { type: "conjunction" }).format(entryNames)}.`;
+  const shortDescription = memberRepos.length === 1 ? shortDescriptionFromReadme((0, import_node_fs27.readFileSync)(readmePath, "utf8")) : `Shared work across ${new Intl.ListFormat("en", { type: "conjunction" }).format(entryNames)}.`;
   const lines = [
     `# ${projectName}`,
     "",
@@ -19901,8 +20576,8 @@ function buildProjectInfoSyncPlan(targetRepo2, project2, projects, repoRoot2) {
   const targetBase = `https://github.com/${targetRepo2}`;
   const targetBranch = branchFor(targetRepo2, projects);
   const orgDocs = [
-    (0, import_node_fs24.existsSync)((0, import_node_path22.join)(repoRoot2, "docs", "org-readme.md")) ? `- [Org identity](${targetBase}/blob/${targetBranch}/docs/org-readme.md)` : "",
-    (0, import_node_fs24.existsSync)((0, import_node_path22.join)(repoRoot2, "docs", "org-architecture.md")) ? `- [Org architecture](${targetBase}/blob/${targetBranch}/docs/org-architecture.md)` : ""
+    (0, import_node_fs27.existsSync)((0, import_node_path25.join)(repoRoot2, "docs", "org-readme.md")) ? `- [Org identity](${targetBase}/blob/${targetBranch}/docs/org-readme.md)` : "",
+    (0, import_node_fs27.existsSync)((0, import_node_path25.join)(repoRoot2, "docs", "org-architecture.md")) ? `- [Org architecture](${targetBase}/blob/${targetBranch}/docs/org-architecture.md)` : ""
   ].filter(Boolean);
   if (orgDocs.length) lines.push("", "## Organisation docs", "", ...orgDocs);
   return { projectId: project2.projectId, projectName, targetRepo: targetRepo2, memberRepos, shortDescription, readme: `${lines.join("\n")}
@@ -20761,9 +21436,9 @@ function writeError(res) {
 }
 
 // src/secrets-commands.ts
-var import_node_fs25 = require("node:fs");
-var import_node_path23 = require("node:path");
-var import_node_os9 = require("node:os");
+var import_node_fs28 = require("node:fs");
+var import_node_path26 = require("node:path");
+var import_node_os10 = require("node:os");
 
 // src/project-runtime.ts
 function hasRuntimeSecretContract(contract) {
@@ -20886,18 +21561,18 @@ function collectMap(value, previous = []) {
   return [...previous, value];
 }
 async function decryptRailsCredentials(input) {
-  const appDir = (0, import_node_path23.resolve)(input.appDir ?? process.cwd());
+  const appDir = (0, import_node_path26.resolve)(input.appDir ?? process.cwd());
   const credentialsFile = input.credentialsFile ?? DEFAULT_RAILS_CREDENTIALS_FILE;
   const masterKeyFile = input.masterKeyFile ?? DEFAULT_RAILS_MASTER_KEY_FILE;
-  const credentialsPath = (0, import_node_path23.resolve)(appDir, credentialsFile);
-  const masterKeyPath = (0, import_node_path23.resolve)(appDir, masterKeyFile);
+  const credentialsPath = (0, import_node_path26.resolve)(appDir, credentialsFile);
+  const masterKeyPath = (0, import_node_path26.resolve)(appDir, masterKeyFile);
   const env = {
     ...process.env,
     MMI_RAILS_CREDENTIALS_FILE: credentialsPath,
     MMI_RAILS_MASTER_KEY_FILE: masterKeyPath
   };
-  if ((0, import_node_fs25.existsSync)(masterKeyPath)) {
-    env.RAILS_MASTER_KEY = (0, import_node_fs25.readFileSync)(masterKeyPath, "utf8").trim();
+  if ((0, import_node_fs28.existsSync)(masterKeyPath)) {
+    env.RAILS_MASTER_KEY = (0, import_node_fs28.readFileSync)(masterKeyPath, "utf8").trim();
   }
   const script = [
     'require "json"',
@@ -20907,9 +21582,9 @@ async function decryptRailsCredentials(input) {
     'config = ActiveSupport::EncryptedConfiguration.new(config_path: config_path, key_path: key_path, env_key: "RAILS_MASTER_KEY", raise_if_missing_key: true)',
     "puts JSON.generate(config.config)"
   ].join("\n");
-  const scriptDir = (0, import_node_fs25.mkdtempSync)((0, import_node_path23.join)((0, import_node_os9.tmpdir)(), "mmi-rails-decrypt-"));
-  const scriptPath = (0, import_node_path23.join)(scriptDir, "decrypt.rb");
-  (0, import_node_fs25.writeFileSync)(scriptPath, script, "utf8");
+  const scriptDir = (0, import_node_fs28.mkdtempSync)((0, import_node_path26.join)((0, import_node_os10.tmpdir)(), "mmi-rails-decrypt-"));
+  const scriptPath = (0, import_node_path26.join)(scriptDir, "decrypt.rb");
+  (0, import_node_fs28.writeFileSync)(scriptPath, script, "utf8");
   try {
     const args = ["exec", "ruby", scriptPath];
     const cmd = process.platform === "win32" ? "cmd.exe" : "bundle";
@@ -20921,7 +21596,7 @@ async function decryptRailsCredentials(input) {
     });
     return JSON.parse(stdout);
   } finally {
-    (0, import_node_fs25.rmSync)(scriptDir, { recursive: true, force: true });
+    (0, import_node_fs28.rmSync)(scriptDir, { recursive: true, force: true });
   }
 }
 async function readSecretStdin() {
@@ -21011,7 +21686,7 @@ function registerSecretsCommands(program3) {
     let body;
     if (o.file) {
       try {
-        body = (0, import_node_fs25.readFileSync)((0, import_node_path23.resolve)(o.file), "utf8");
+        body = (0, import_node_fs28.readFileSync)((0, import_node_path26.resolve)(o.file), "utf8");
       } catch (e) {
         return fail(`secrets org-catalog: cannot read --file ${o.file}: ${e.message}`);
       }
@@ -21116,7 +21791,7 @@ function registerSecretsCommands(program3) {
       {
         ...d,
         decryptRailsCredentials,
-        removeFile: (path2) => (0, import_node_fs25.unlinkSync)((0, import_node_path23.resolve)(o.appDir ?? process.cwd(), path2))
+        removeFile: (path2) => (0, import_node_fs28.unlinkSync)((0, import_node_path26.resolve)(o.appDir ?? process.cwd(), path2))
       },
       {
         repo: o.repo,
@@ -21161,7 +21836,7 @@ function registerSecretsCommands(program3) {
 }
 
 // src/app-actor.ts
-var import_node_crypto4 = require("node:crypto");
+var import_node_crypto5 = require("node:crypto");
 var APP_ACTOR_ENV = "MMI_ACTOR";
 var APP_VAULT_REPO = "mutmutco/MMI-Hub";
 var APP_VAULT_KEYS = ["GITHUB_APP_ID", "GITHUB_APP_INSTALLATION_ID", "GITHUB_APP_PRIVATE_KEY"];
@@ -21205,7 +21880,7 @@ function mintAppJwt(appId, privateKeyPem, nowSec) {
     exp: now + APP_JWT_TTL_S,
     iss: appId
   }));
-  const signer = (0, import_node_crypto4.createSign)("RSA-SHA256");
+  const signer = (0, import_node_crypto5.createSign)("RSA-SHA256");
   signer.update(`${header}.${payload}`);
   return `${header}.${payload}.${signer.sign(privateKeyPem, "base64url")}`;
 }
@@ -21280,7 +21955,7 @@ async function activateAppActor(commandPath3, env, mint) {
 }
 
 // src/box-commands.ts
-var import_node_fs26 = require("node:fs");
+var import_node_fs29 = require("node:fs");
 
 // src/box.ts
 var BOX_KEYS = {
@@ -21483,7 +22158,7 @@ function registerBoxCommands(program3) {
       }
       if (o.json) console.log(JSON.stringify({ box: found, incomplete }, null, 2));
       else if (o.ssh && o.script) {
-        (0, import_node_fs26.writeFileSync)(o.script, sshRecipeScript(found), "utf8");
+        (0, import_node_fs29.writeFileSync)(o.script, sshRecipeScript(found), "utf8");
         console.log(`wrote ${o.script} \u2014 run: bash "${o.script}"`);
       } else if (o.ssh) console.log(`${formatSshRecipe(found)}
 ${SSH_RECIPE_AGENT_NOTE}`);
@@ -21498,7 +22173,7 @@ ${SSH_RECIPE_AGENT_NOTE}`);
 
 // src/schedules-commands.ts
 var import_promises4 = require("node:fs/promises");
-var import_node_child_process13 = require("node:child_process");
+var import_node_child_process15 = require("node:child_process");
 var import_node_util7 = require("node:util");
 
 // src/schedules.ts
@@ -21622,9 +22297,9 @@ function extractWorkflowCrons(yamlText) {
 function workflowEntry(repo, workflowPath, yamlText) {
   const crons = extractWorkflowCrons(yamlText);
   if (!crons.length) return null;
-  const basename4 = workflowPath.split("/").pop() ?? workflowPath;
+  const basename5 = workflowPath.split("/").pop() ?? workflowPath;
   return {
-    name: `${repo}/${basename4.replace(/\.ya?ml$/, "")}`,
+    name: `${repo}/${basename5.replace(/\.ya?ml$/, "")}`,
     cadence: crons.join(" + "),
     executor: "github-actions",
     llm: llmFromHeader(yamlText),
@@ -21737,6 +22412,9 @@ var DECLARED_ENTRIES = [
   // unavailable exactly when it is needed. This one is root cron on the box: no checkout, no node, and
   // a no-op below 90% disk, which is why 15 minutes is affordable.
   { name: "mmi-runner-hygiene-oob (mmi-runner)", cadence: "*/15 * * * *", executor: "box cron.d", llm: "no", resolved: "declared", source: "/etc/cron.d/mmi-runner-hygiene \u2192 /opt/mmi-control/runner-hygiene-oob.sh; acts only at >=90% disk (verify: mmi-cli runtime box get mmi-runner --ssh)" },
+  // #4118: Listening + systemd-active ≠ GitHub online after acquirejob 503. restart.conf cannot see
+  // it; an Actions workflow on mmi-live cannot heal it when half the fleet is offline. Root cron.
+  { name: "mmi-runner-online-reconcile (mmi-runner)", cadence: "*/5 * * * *", executor: "box cron.d", llm: "no", resolved: "declared", source: "/etc/cron.d/mmi-runner-online \u2192 /opt/mmi-control/runner-online-reconcile.sh; API-offline + _diag acquirejob, max 2 restarts/tick (verify: mmi-cli runtime box get mmi-runner --ssh)" },
   { name: "zuber-bake", cadence: "*:05/30 (every 30 min)", executor: "zuber systemd timer", llm: "no", resolved: "declared", source: "zuber-bake.timer \u2192 rolling overlay bake, metro tier, next ~6h window (verify over ssh)" },
   { name: "zuber-bake-full", cadence: "00:30 UTC (03:30 TRT, daily)", executor: "zuber systemd timer", llm: "no", resolved: "declared", source: "zuber-bake-full.timer \u2192 full 24h overlay rebuild, all 81 il (verify over ssh)" }
 ];
@@ -21932,7 +22610,7 @@ function assembleReconciliation(githubEntries2, readRepos, registry2, activeWork
 }
 
 // src/schedules-commands.ts
-var execFileP5 = (0, import_node_util7.promisify)(import_node_child_process13.execFile);
+var execFileP5 = (0, import_node_util7.promisify)(import_node_child_process15.execFile);
 var AWS_REGION = "eu-central-1";
 var AWS_TIMEOUT_MS = 3e4;
 var AWS_RETRY_DELAY_MS = 1500;
@@ -21966,8 +22644,8 @@ async function repoWorkflowEntries(client, repo) {
       );
       if (typeof contents?.content !== "string" || contents.encoding !== "base64") continue;
       const text = Buffer.from(contents.content, "base64").toString("utf8");
-      const basename4 = wf.path.split("/").pop() ?? wf.path;
-      const name = `${repo}/${basename4.replace(/\.ya?ml$/, "")}`;
+      const basename5 = wf.path.split("/").pop() ?? wf.path;
+      const name = `${repo}/${basename5.replace(/\.ya?ml$/, "")}`;
       workflows.push({ name, yamlText: text });
       const entry = workflowEntry(repo, wf.path, text);
       if (entry) entries.push(entry);
@@ -22098,7 +22776,7 @@ function reportDrift(drift) {
   for (const d of drift) console.error(`org schedules: DRIFT \u2014 ${d}`);
 }
 function registerSchedulesCommands(program3) {
-  const schedules = program3.command("schedules").description("the org schedules notebook \u2014 every armed cron, timer, and scheduled LLM lane, resolved live (jerv side lives in jerv-cli schedules)").option("--json", "machine-readable output (consumed by jerv-cli schedules --all)").option("--doc <path>", "splice the generated inventory into the given doc between the schedules:inventory markers (docs/schedules.md)").action(async (o) => {
+  const schedules = program3.command("schedules").description("the org schedules notebook \u2014 every armed cron, timer, and scheduled LLM lane, resolved live (jerv side lives in jerv-cli schedules)").option("--json", "machine-readable output (consumed by jerv-cli schedules --all)").option("--doc <path>", "optional snapshot only \u2014 splice inventory between schedules:inventory markers; live `org schedules` / --json remains SSOT (Hub#4120)").action(async (o) => {
     try {
       const { entries, incomplete, drift, reconciliation } = await fetchNotebook();
       if (o.doc) {
@@ -22169,7 +22847,7 @@ function registerSchedulesCommands(program3) {
 
 // src/file-lock.ts
 var import_promises5 = require("node:fs/promises");
-var import_node_path24 = require("node:path");
+var import_node_path27 = require("node:path");
 var sleep = (ms) => new Promise((resolve5) => setTimeout(resolve5, ms));
 var IMMEDIATE_RETRY_BUDGET = 3;
 var FileLockBusyError = class extends Error {
@@ -22254,7 +22932,7 @@ async function releaseFileLock(lockPath, guard) {
 }
 async function withFileLock(lockPath, opts, fn) {
   const resolved = resolveFileLockOpts(opts);
-  await (0, import_promises5.mkdir)((0, import_node_path24.dirname)(lockPath), { recursive: true }).catch(() => void 0);
+  await (0, import_promises5.mkdir)((0, import_node_path27.dirname)(lockPath), { recursive: true }).catch(() => void 0);
   const guard = await acquireFileLock(lockPath, resolved, Date.now() + resolved.maxWaitMs);
   try {
     return await fn();
@@ -22265,7 +22943,7 @@ async function withFileLock(lockPath, opts, fn) {
 
 // src/schedules-lift-command.ts
 var import_promises6 = require("node:fs/promises");
-var import_node_path25 = require("node:path");
+var import_node_path28 = require("node:path");
 
 // src/schedules-lift.ts
 var SCHEDULE_HEADER_FIELDS = ["schedule", "what", "owner", "cadence", "executor", "llm", "output", "breaks", "kill"];
@@ -22287,8 +22965,8 @@ function scheduleRecordFromWorkflow(repo, workflowPath, yamlText) {
   const crons = extractWorkflowCrons(yamlText);
   const header = parseScheduleHeader(yamlText);
   if (!crons.length && !header.schedule) return null;
-  const basename4 = workflowPath.split("/").pop() ?? workflowPath;
-  const expectedId = `${repo}/${basename4.replace(/\.ya?ml$/, "")}`;
+  const basename5 = workflowPath.split("/").pop() ?? workflowPath;
+  const expectedId = `${repo}/${basename5.replace(/\.ya?ml$/, "")}`;
   const missing = SCHEDULE_HEADER_FIELDS.filter((f) => !header[f]);
   if (missing.length) {
     throw new Error(`schedules register: ${expectedId} (${workflowPath}) is a scheduled workflow but is missing the eight-field entry-template header field(s): ${missing.join(", ")} \u2014 see docs/schedules.md "The entry template".`);
@@ -22371,7 +23049,7 @@ async function readWorkflowFiles(dir) {
   const files = [];
   for (const name of names.sort()) {
     if (!/\.ya?ml$/.test(name)) continue;
-    files.push({ path: `.github/workflows/${name}`, text: await (0, import_promises6.readFile)((0, import_node_path25.join)(dir, name), "utf8") });
+    files.push({ path: `.github/workflows/${name}`, text: await (0, import_promises6.readFile)((0, import_node_path28.join)(dir, name), "utf8") });
   }
   return files;
 }
@@ -22913,9 +23591,9 @@ function registerQueryCommands(program3) {
 }
 
 // src/bootstrap-commands.ts
-var import_node_fs27 = require("node:fs");
-var import_node_os10 = require("node:os");
-var import_node_path26 = require("node:path");
+var import_node_fs30 = require("node:fs");
+var import_node_os11 = require("node:os");
+var import_node_path29 = require("node:path");
 
 // src/bootstrap-drift.ts
 function byteComparableSeeds(manifest, cls) {
@@ -23445,6 +24123,12 @@ async function verifyBootstrap(repo, repoClass, deps, releaseTrack) {
       detail: optionDetail(missing)
     });
   } else if (repoClass === "deployable") {
+    const productRuleset = rulesets.find((r) => r.name === PRODUCT_RULESET_NAME);
+    checks.push({
+      ok: productRuleset?.enforcement === "active",
+      label: "product required-check ruleset enforcement active",
+      detail: productRuleset?.enforcement !== "active" ? `${PRODUCT_RULESET_NAME} is ${productRuleset?.enforcement ?? "missing"} \u2014 run mmi-cli ci reconcile --apply --repo ${repo} once the gate is green` : void 0
+    });
     const statusChecks = rulesetStatusChecks2(rulesets.filter((r) => r.target === "branch" && r.enforcement === "active"));
     const missing = requiredProductStatusChecks.filter((check) => !statusChecks.has(check));
     checks.push({
@@ -23622,13 +24306,13 @@ function registerBootstrapCommands(program3) {
       client: defaultGitHubClient(),
       projectMeta: meta,
       deployModel: typeof meta?.deployModel === "string" ? meta.deployModel : void 0,
-      readLocalFile: (path2) => path2 === "projects.json" && apiProjects != null ? apiProjects : (0, import_node_fs27.existsSync)(path2) ? (0, import_node_fs27.readFileSync)(path2, "utf8") : null,
+      readLocalFile: (path2) => path2 === "projects.json" && apiProjects != null ? apiProjects : (0, import_node_fs30.existsSync)(path2) ? (0, import_node_fs30.readFileSync)(path2, "utf8") : null,
       // requiredGcpApis is stored as an array by a JSON write, but `org project set --var KEY=VALUE` stores a raw
       // comma-string — accept either so the seeded value verifies regardless of how it was written.
       // #3689: the same committed map the org access audit reads (#3664), so a sanctioned admin is not a
       // permanent bootstrap failure on one surface and an intended state on the other. Absent file → no
       // sanction, which is the pre-#3664 behaviour.
-      sanctionedAdmins: (0, import_node_fs27.existsSync)("access-matrix.json") ? entriesValueByCanonicalRepo(loadSanctionedAdmins((0, import_node_fs27.readFileSync)("access-matrix.json", "utf8")), repo) : void 0,
+      sanctionedAdmins: (0, import_node_fs30.existsSync)("access-matrix.json") ? entriesValueByCanonicalRepo(loadSanctionedAdmins((0, import_node_fs30.readFileSync)("access-matrix.json", "utf8")), repo) : void 0,
       requiredGcpApis: (() => {
         const v = meta?.requiredGcpApis;
         if (Array.isArray(v)) return v;
@@ -23681,12 +24365,12 @@ function registerBootstrapCommands(program3) {
   bootstrap.command("drift").description("#3818: compare every org-owned whole-file seed against MMI-Hub's copy across the registry roster; read-only").option("--repo <owner/repo>", "audit one repo instead of the roster (never a fleet verdict)").option("--json", "machine-readable output").action(async () => {
     const o = { repo: rawValue("--repo", ""), json: rawFlag("--json") };
     const manifestPath = "skills/bootstrap/seeds/manifest.json";
-    if (!(0, import_node_fs27.existsSync)(manifestPath)) return fail(`bootstrap drift: ${manifestPath} not found; run from the MMI-Hub repo root \u2014 the Hub's copies ARE the reference this compares against`);
-    const manifest = loadBootstrapSeeds((0, import_node_fs27.readFileSync)(manifestPath, "utf8"));
+    if (!(0, import_node_fs30.existsSync)(manifestPath)) return fail(`bootstrap drift: ${manifestPath} not found; run from the MMI-Hub repo root \u2014 the Hub's copies ARE the reference this compares against`);
+    const manifest = loadBootstrapSeeds((0, import_node_fs30.readFileSync)(manifestPath, "utf8"));
     const hubContents = /* @__PURE__ */ new Map();
     for (const s of manifest.seeds) {
       if (s.ownership !== "org" || s.source !== "self") continue;
-      hubContents.set(s.target, (0, import_node_fs27.existsSync)(s.target) ? (0, import_node_fs27.readFileSync)(s.target, "utf8") : null);
+      hubContents.set(s.target, (0, import_node_fs30.existsSync)(s.target) ? (0, import_node_fs30.readFileSync)(s.target, "utf8") : null);
     }
     let targets;
     let classOf = (_repo) => "deployable";
@@ -23763,8 +24447,8 @@ function registerBootstrapCommands(program3) {
       return fail(`bootstrap apply: ${e.message}`);
     }
     const manifestPath = "skills/bootstrap/seeds/manifest.json";
-    if (!(0, import_node_fs27.existsSync)(manifestPath)) return fail(`bootstrap apply: ${manifestPath} not found; bootstrap runs from the MMI-Hub repo root by design \u2014 it stamps org-level resources (Project, Ruleset, secrets, access) through the GitHub App, which is only authorized from the Hub checkout`);
-    const manifest = loadBootstrapSeeds((0, import_node_fs27.readFileSync)(manifestPath, "utf8"));
+    if (!(0, import_node_fs30.existsSync)(manifestPath)) return fail(`bootstrap apply: ${manifestPath} not found; bootstrap runs from the MMI-Hub repo root by design \u2014 it stamps org-level resources (Project, Ruleset, secrets, access) through the GitHub App, which is only authorized from the Hub checkout`);
+    const manifest = loadBootstrapSeeds((0, import_node_fs30.readFileSync)(manifestPath, "utf8"));
     const baseBranch = o.class === "content" ? "main" : "development";
     const slug = parsedRepo.slug;
     const onlyTarget = o.only.trim();
@@ -23775,16 +24459,16 @@ function registerBootstrapCommands(program3) {
   ${known}`);
     }
     const gh = async (args) => execFileP2("gh", args, { timeout: 2e4 });
-    const readFile9 = (p) => (0, import_node_fs27.existsSync)(p) ? (0, import_node_fs27.readFileSync)(p, "utf8") : null;
+    const readFile9 = (p) => (0, import_node_fs30.existsSync)(p) ? (0, import_node_fs30.readFileSync)(p, "utf8") : null;
     const enc = (p) => p.split("/").map(encodeURIComponent).join("/");
     const putSeed = async (target, content, ref, sha) => {
-      const tmp = (0, import_node_path26.join)((0, import_node_os10.tmpdir)(), `mmi-seed-${process.pid}-${Date.now().toString(36)}-${Math.random().toString(36).slice(2)}.json`);
-      (0, import_node_fs27.writeFileSync)(tmp, JSON.stringify(contentPutBody(target, content, ref, sha)), "utf8");
+      const tmp = (0, import_node_path29.join)((0, import_node_os11.tmpdir)(), `mmi-seed-${process.pid}-${Date.now().toString(36)}-${Math.random().toString(36).slice(2)}.json`);
+      (0, import_node_fs30.writeFileSync)(tmp, JSON.stringify(contentPutBody(target, content, ref, sha)), "utf8");
       try {
         await gh(contentPutInputArgs(repo, target, tmp));
       } finally {
         try {
-          (0, import_node_fs27.unlinkSync)(tmp);
+          (0, import_node_fs30.unlinkSync)(tmp);
         } catch {
         }
       }
@@ -24041,12 +24725,12 @@ LIVE apply to ${repo}:
 }
 
 // src/stage-commands.ts
-var import_node_fs29 = require("node:fs");
-var import_node_path28 = require("node:path");
+var import_node_fs32 = require("node:fs");
+var import_node_path31 = require("node:path");
 
 // src/port-registry.ts
-var import_node_fs28 = require("node:fs");
-var import_node_path27 = require("node:path");
+var import_node_fs31 = require("node:fs");
+var import_node_path30 = require("node:path");
 
 // ../infra/port-geometry.mjs
 var PORT_BLOCK = 100;
@@ -24060,8 +24744,8 @@ function nextPortBlock(registry2) {
   return [base, base + PORT_SPAN];
 }
 function loadPortRegistry(path2) {
-  if (!(0, import_node_fs28.existsSync)(path2)) return {};
-  const raw = JSON.parse((0, import_node_fs28.readFileSync)(path2, "utf8"));
+  if (!(0, import_node_fs31.existsSync)(path2)) return {};
+  const raw = JSON.parse((0, import_node_fs31.readFileSync)(path2, "utf8"));
   const out = {};
   for (const [key, value] of Object.entries(raw)) {
     if (Array.isArray(value) && value.length === 2 && value.every((n) => typeof n === "number")) {
@@ -24075,9 +24759,9 @@ function ensurePortRange(repo, path2) {
   const existing = registry2[repo];
   if (existing) return existing;
   const range = nextPortBlock(registry2);
-  const raw = (0, import_node_fs28.existsSync)(path2) ? JSON.parse((0, import_node_fs28.readFileSync)(path2, "utf8")) : {};
+  const raw = (0, import_node_fs31.existsSync)(path2) ? JSON.parse((0, import_node_fs31.readFileSync)(path2, "utf8")) : {};
   raw[repo] = range;
-  (0, import_node_fs28.writeFileSync)(path2, JSON.stringify(raw, null, 2) + "\n", "utf8");
+  (0, import_node_fs31.writeFileSync)(path2, JSON.stringify(raw, null, 2) + "\n", "utf8");
   return range;
 }
 function portCursorSeed(registry2) {
@@ -24099,22 +24783,22 @@ function existingPortRange(repo, registry2) {
   return registry2[repo] ?? null;
 }
 function portRangeInfraAt(root, source) {
-  const registryPath = (0, import_node_path27.join)(root, "infra", "port-ranges.json");
-  const ddbScriptPath = (0, import_node_path27.join)(root, "infra", "port-ddb.mjs");
-  if (!(0, import_node_fs28.existsSync)(registryPath) || !(0, import_node_fs28.existsSync)(ddbScriptPath)) return null;
+  const registryPath = (0, import_node_path30.join)(root, "infra", "port-ranges.json");
+  const ddbScriptPath = (0, import_node_path30.join)(root, "infra", "port-ddb.mjs");
+  if (!(0, import_node_fs31.existsSync)(registryPath) || !(0, import_node_fs31.existsSync)(ddbScriptPath)) return null;
   return { root, source, registryPath, ddbScriptPath };
 }
 function resolvePortRangeInfra(cwd, packageDir) {
   const direct = portRangeInfraAt(cwd, "cwd");
   if (direct) return direct;
-  for (let dir = cwd; ; dir = (0, import_node_path27.dirname)(dir)) {
-    const sibling = portRangeInfraAt((0, import_node_path27.join)(dir, "MMI-Hub"), "sibling-hub");
+  for (let dir = cwd; ; dir = (0, import_node_path30.dirname)(dir)) {
+    const sibling = portRangeInfraAt((0, import_node_path30.join)(dir, "MMI-Hub"), "sibling-hub");
     if (sibling) return sibling;
-    const parent = (0, import_node_path27.dirname)(dir);
+    const parent = (0, import_node_path30.dirname)(dir);
     if (parent === dir) break;
   }
   if (packageDir) {
-    const pkgRoot = (0, import_node_path27.join)(packageDir, "..", "..");
+    const pkgRoot = (0, import_node_path30.join)(packageDir, "..", "..");
     const pkgFrom = portRangeInfraAt(pkgRoot, "pkg-root");
     if (pkgFrom) return pkgFrom;
   }
@@ -24308,8 +24992,8 @@ function registerStageCommands(program3) {
     const portRange = portRangeMeta && typeof portRangeMeta.start === "number" && typeof portRangeMeta.end === "number" ? [portRangeMeta.start, portRangeMeta.end] : void 0;
     return decideStage({
       registry: { deployModel: project2?.deployModel, portRange, error: read.ok ? void 0 : read.error },
-      hasCompose: (0, import_node_fs29.existsSync)((0, import_node_path28.join)(process.cwd(), "docker-compose.yml")),
-      hasEnvExample: (0, import_node_fs29.existsSync)((0, import_node_path28.join)(process.cwd(), ".env.example"))
+      hasCompose: (0, import_node_fs32.existsSync)((0, import_node_path31.join)(process.cwd(), "docker-compose.yml")),
+      hasEnvExample: (0, import_node_fs32.existsSync)((0, import_node_path31.join)(process.cwd(), ".env.example"))
     });
   }
   async function fetchStageVaultEnvMerge() {
@@ -24747,11 +25431,11 @@ function registerBoardCommands(program3) {
 }
 
 // src/merge-cleanup.ts
-var import_node_fs30 = require("node:fs");
+var import_node_fs33 = require("node:fs");
 var import_promises8 = require("node:fs/promises");
-var import_node_path30 = require("node:path");
-var import_node_os11 = require("node:os");
-var import_node_child_process14 = require("node:child_process");
+var import_node_path33 = require("node:path");
+var import_node_os12 = require("node:os");
+var import_node_child_process16 = require("node:child_process");
 
 // src/board-advance.ts
 function repoOf2(ref) {
@@ -24837,7 +25521,7 @@ function boardAdvanceFailureMessage(result) {
 
 // src/deferred-registry-store.ts
 var import_promises7 = require("node:fs/promises");
-var import_node_path29 = require("node:path");
+var import_node_path32 = require("node:path");
 var sleep2 = (ms) => new Promise((resolve5) => setTimeout(resolve5, ms));
 async function atomicWrite(target, contents) {
   const tmp = `${target}.tmp-${process.pid}-${Math.random().toString(36).slice(2)}`;
@@ -24888,12 +25572,12 @@ function makeDeferredWorktreeStore(registryPath, lockOpts = {}) {
     },
     // Standalone atomic write — THROWS on failure (no best-effort swallow, #2846).
     write: async (entries) => {
-      await (0, import_promises7.mkdir)((0, import_node_path29.dirname)(registryPath), { recursive: true });
+      await (0, import_promises7.mkdir)((0, import_node_path32.dirname)(registryPath), { recursive: true });
       await atomicWrite(registryPath, serializeDeferredWorktrees(entries));
     },
     // Serialized read-modify-write under the repo-wide lock (#2846).
     update: async (mutate) => {
-      await (0, import_promises7.mkdir)((0, import_node_path29.dirname)(registryPath), { recursive: true });
+      await (0, import_promises7.mkdir)((0, import_node_path32.dirname)(registryPath), { recursive: true });
       const deadline = Date.now() + opts.maxWaitMs;
       for (; ; ) {
         const guard = await acquireLock(lockPath, opts, deadline);
@@ -25041,7 +25725,7 @@ async function applyGcPlan(plan, remote, opts = {}) {
   );
   const repoRoot2 = (await execFileP2("git", ["rev-parse", "--show-toplevel"], { timeout: GIT_TIMEOUT_MS }).catch(() => ({ stdout: "" }))).stdout.trim() || process.cwd();
   const worktreeGitRoot = await currentRepoWorktreeGitRoot(repoRoot2);
-  const primaryRepoRoot = worktreeGitRoot ? (0, import_node_path30.dirname)((0, import_node_path30.dirname)(worktreeGitRoot)) : repoRoot2;
+  const primaryRepoRoot = worktreeGitRoot ? (0, import_node_path33.dirname)((0, import_node_path33.dirname)(worktreeGitRoot)) : repoRoot2;
   const gcActor = describeActor({ env: process.env, surface: detectSurface(process.env), cwd: process.cwd() });
   const owners = readWorktreeOwners(primaryRepoRoot);
   const removalNow = Date.now();
@@ -25072,7 +25756,7 @@ async function applyGcPlan(plan, remote, opts = {}) {
       const cleanup = await cleanupPrMergeLocalBranch(branch.branch, {
         beforeWorktrees,
         startingPath: branch.worktreePath,
-        pathExists: (p) => (0, import_node_fs30.existsSync)(p),
+        pathExists: (p) => (0, import_node_fs33.existsSync)(p),
         execGit: async (args) => (await execFileP2("git", args, { timeout: GIT_TIMEOUT_MS })).stdout,
         teardownWorktreeStage,
         deferredStore,
@@ -25100,7 +25784,7 @@ async function applyGcPlan(plan, remote, opts = {}) {
     let removalAttempted = false;
     try {
       const cleanupTarget = resolveSafeSiblingWorktreeCleanupTarget(wt.path, siblingRoot, {
-        realpath: (path2) => (0, import_node_fs30.realpathSync)(path2)
+        realpath: (path2) => (0, import_node_fs33.realpathSync)(path2)
       });
       if (!cleanupTarget.ok) {
         result.failed.push(`${wt.path}: ${cleanupTarget.reason}`);
@@ -25186,13 +25870,13 @@ async function composeOverrideBodyFile(prNumber, repoArgs, gh) {
     const commits = JSON.parse(raw).commits ?? [];
     const body = squashBodyWithOverride(commits.map((c) => ({ headline: c.messageHeadline ?? "", body: c.messageBody ?? "" })), process.cwd());
     if (!body) return void 0;
-    const dir = (0, import_node_fs30.mkdtempSync)((0, import_node_path30.join)((0, import_node_os11.tmpdir)(), "mmi-squash-body-"));
-    const path2 = (0, import_node_path30.join)(dir, "body.txt");
-    (0, import_node_fs30.writeFileSync)(path2, `${body}
+    const dir = (0, import_node_fs33.mkdtempSync)((0, import_node_path33.join)((0, import_node_os12.tmpdir)(), "mmi-squash-body-"));
+    const path2 = (0, import_node_path33.join)(dir, "body.txt");
+    (0, import_node_fs33.writeFileSync)(path2, `${body}
 `, "utf8");
     return { path: path2, cleanup: () => {
       try {
-        (0, import_node_fs30.rmSync)(dir, { recursive: true, force: true });
+        (0, import_node_fs33.rmSync)(dir, { recursive: true, force: true });
       } catch {
       }
     } };
@@ -25300,7 +25984,7 @@ async function remoteBranchExists2(branch, options = {}) {
 }
 var COMPOSE_TIMEOUT_MS = 12e4;
 function spawnDeferredGcSweep() {
-  spawnDetachedSelf(["worktree", "gc", "sweep-deferred", "--quiet"], { spawn: import_node_child_process14.spawn, execPath: process.execPath, scriptPath: process.argv[1] });
+  spawnDetachedSelf(["worktree", "gc", "sweep-deferred", "--quiet"], { spawn: import_node_child_process16.spawn, execPath: process.execPath, scriptPath: process.argv[1] });
 }
 async function createDeferredWorktreeStore() {
   try {
@@ -25314,13 +25998,13 @@ var realWorktreeDirRemover = {
   probe: (p) => {
     let st;
     try {
-      st = (0, import_node_fs30.lstatSync)(p);
+      st = (0, import_node_fs33.lstatSync)(p);
     } catch {
       return null;
     }
     if (st.isSymbolicLink()) return "link";
     try {
-      (0, import_node_fs30.readlinkSync)(p);
+      (0, import_node_fs33.readlinkSync)(p);
       return "link";
     } catch {
     }
@@ -25328,7 +26012,7 @@ var realWorktreeDirRemover = {
   },
   readdir: (p) => {
     try {
-      return (0, import_node_fs30.readdirSync)(p);
+      return (0, import_node_fs33.readdirSync)(p);
     } catch {
       return [];
     }
@@ -25337,9 +26021,9 @@ var realWorktreeDirRemover = {
   // leaving the target); a file symlink with unlink. rmdir first, fall back to unlink.
   detachLink: (p) => {
     try {
-      (0, import_node_fs30.rmdirSync)(p);
+      (0, import_node_fs33.rmdirSync)(p);
     } catch {
-      (0, import_node_fs30.unlinkSync)(p);
+      (0, import_node_fs33.unlinkSync)(p);
     }
   },
   removeTree: (p) => (0, import_promises8.rm)(p, { recursive: true, force: true, maxRetries: 5, retryDelay: 200 })
@@ -25372,9 +26056,9 @@ async function worktreeHasStageState(worktreePath) {
   }
 }
 function stageStateFileBelongsToWorktree(statePath, worktreePath) {
-  if (!(0, import_node_fs30.existsSync)(statePath)) return false;
+  if (!(0, import_node_fs33.existsSync)(statePath)) return false;
   try {
-    const state = JSON.parse((0, import_node_fs30.readFileSync)(statePath, "utf8"));
+    const state = JSON.parse((0, import_node_fs33.readFileSync)(statePath, "utf8"));
     const recordedCwd = typeof state.identity?.cwd === "string" ? state.identity.cwd : typeof state.cwd === "string" ? state.cwd : "";
     return Boolean(recordedCwd && isPathUnderDirectory(recordedCwd, worktreePath));
   } catch {
@@ -25534,24 +26218,48 @@ var RUNNER_INFRA_ANNOTATION_TITLES = /* @__PURE__ */ new Set([
   CI_DISK_ANNOTATION_TITLE,
   CI_TOOLCHAIN_ANNOTATION_TITLE
 ]);
+var RUNNER_INFRA_ANNOTATION_MESSAGE_PATTERNS = [
+  /not acquired by Runner/i,
+  /Service Unavailable/i,
+  /Failed to resolve action download info/i
+];
+var RUNNER_INFRA_PRESTART_CONCLUSIONS = /* @__PURE__ */ new Set([
+  "cancelled",
+  "startup_failure"
+]);
 function isErrorAnnotation(a) {
   const level = a.annotation_level?.toLowerCase();
   return level === "failure" || level === "error";
 }
+function isRunnerInfraAnnotation(a) {
+  const title = a.title?.trim() ?? "";
+  if (RUNNER_INFRA_ANNOTATION_TITLES.has(title)) return true;
+  const text = `${title}
+${a.message?.trim() ?? ""}`;
+  return RUNNER_INFRA_ANNOTATION_MESSAGE_PATTERNS.some((re) => re.test(text));
+}
 function classifyFailedChecks(failing) {
   const infraFailures = [];
   const otherFailures = [];
   for (const check of failing) {
     const errors = check.annotations.filter(isErrorAnnotation);
-    const allInfra = errors.length > 0 && errors.every((a) => RUNNER_INFRA_ANNOTATION_TITLES.has(a.title?.trim() ?? ""));
-    (allInfra ? infraFailures : otherFailures).push(check.name);
+    if (errors.length > 0) {
+      const allInfra = errors.every((a) => isRunnerInfraAnnotation(a));
+      (allInfra ? infraFailures : otherFailures).push(check.name);
+      continue;
+    }
+    if (RUNNER_INFRA_PRESTART_CONCLUSIONS.has(check.conclusion?.trim() ?? "")) {
+      infraFailures.push(check.name);
+      continue;
+    }
+    otherFailures.push(check.name);
   }
   if (infraFailures.length && !otherFailures.length) {
     return {
       cause: "runner-infra",
       infraFailures,
       otherFailures,
-      reason: `${infraFailures.length} check(s) failed on RUNNER INFRASTRUCTURE, not your diff: ${infraFailures.join(", ")}. No test failed \u2014 the shared runner hit a wall-clock budget kill, ran out of disk, or was missing a toolchain (the check annotation names which). Re-run once the runner drains/heals (gh run rerun --failed); do not debug the diff.`
+      reason: `${infraFailures.length} check(s) failed on RUNNER INFRASTRUCTURE, not your diff: ${infraFailures.join(", ")}. No test failed \u2014 the shared runner hit a wall-clock budget kill, ran out of disk, was missing a toolchain, could not acquire an mmi-live lane, or Actions returned Service Unavailable before checkout (the check annotation / conclusion names which). Re-run once the runner drains/heals (gh run rerun --failed); do not debug the diff.`
     };
   }
   return {
@@ -25579,6 +26287,7 @@ async function diagnoseFailedRestChecks(prNumber, repo, gh = defaultGhApi) {
     if (!failing.length) return null;
     const annotated = await Promise.all(failing.map(async (run) => ({
       name: run.name ?? `check-run ${run.id}`,
+      conclusion: run.conclusion ?? null,
       annotations: JSON.parse(await gh([`repos/${repo}/check-runs/${run.id}/annotations`]))
     })));
     return classifyFailedChecks(annotated);
@@ -25680,9 +26389,9 @@ async function checkDocsIndexAtHead(opts, deps) {
 }
 
 // src/worktree-lifecycle-commands.ts
-var import_node_fs31 = require("node:fs");
+var import_node_fs34 = require("node:fs");
 var import_promises9 = require("node:fs/promises");
-var import_node_path31 = require("node:path");
+var import_node_path34 = require("node:path");
 var GH_TIMEOUT_MS = 2e4;
 var DEFAULT_BASE = "origin/development";
 var DEFAULT_REMOTE = "origin";
@@ -25828,7 +26537,7 @@ function classifyStaleLeaks(input) {
 var defaultOrphanDirScanDeps = {
   listDirs: (root) => {
     try {
-      return (0, import_node_fs31.readdirSync)(root, { withFileTypes: true }).filter((e) => e.isDirectory()).map((e) => (0, import_node_path31.join)(root, e.name));
+      return (0, import_node_fs34.readdirSync)(root, { withFileTypes: true }).filter((e) => e.isDirectory()).map((e) => (0, import_node_path34.join)(root, e.name));
     } catch {
       return [];
     }
@@ -25981,13 +26690,13 @@ function registerWorktreeCommands(program3) {
       const detached = headBorn && !symbolicBranch;
       const branch = symbolicBranch || (detached ? "HEAD" : "");
       if (!wtPath || !branch) return fail("worktree land: not inside a git worktree");
-      const gitFile = (0, import_node_path31.join)(wtPath, ".git");
-      const isLinked = (0, import_node_fs31.existsSync)(gitFile) && (0, import_node_fs31.statSync)(gitFile).isFile();
+      const gitFile = (0, import_node_path34.join)(wtPath, ".git");
+      const isLinked = (0, import_node_fs34.existsSync)(gitFile) && (0, import_node_fs34.statSync)(gitFile).isFile();
       if (apply && !isLinked) {
         return fail("worktree land: run from inside the linked worktree you want to land (this is the primary checkout)");
       }
       const commonDir = (await execFileP2("git", ["rev-parse", "--git-common-dir"], { timeout: GIT_TIMEOUT_MS }).catch(() => ({ stdout: "" }))).stdout.trim();
-      const primaryCheckout = commonDir ? (0, import_node_path31.dirname)(commonDir) : wtPath;
+      const primaryCheckout = commonDir ? (0, import_node_path34.dirname)(commonDir) : wtPath;
       const localBranchNames = await execFileP2("git", ["-C", primaryCheckout, "for-each-ref", "--format=%(refname:short)", "refs/heads"], { timeout: GIT_TIMEOUT_MS }).then(({ stdout }) => new Set((stdout || "").split("\n").map((l) => l.trim()).filter(Boolean))).catch(() => void 0);
       const orphan = classifyOrphanedWorktree({
         branch,
@@ -26198,10 +26907,10 @@ async function gatherWorktreeContext() {
     if (s) stages.push({ path: wt.path, port: s.port });
   }
   const worktreeGitRoot = await currentRepoWorktreeGitRoot(repoRoot2);
-  const primaryRepoRoot = worktreeGitRoot ? (0, import_node_path31.dirname)((0, import_node_path31.dirname)(worktreeGitRoot)) : repoRoot2;
+  const primaryRepoRoot = worktreeGitRoot ? (0, import_node_path34.dirname)((0, import_node_path34.dirname)(worktreeGitRoot)) : repoRoot2;
   const wtRoot = siblingMmiWorktreesRoot(primaryRepoRoot);
   let orphanDirs = [];
-  if ((0, import_node_fs31.existsSync)(wtRoot)) {
+  if ((0, import_node_fs34.existsSync)(wtRoot)) {
     orphanDirs = scanOrphanDirs(wtRoot, worktreeGitRoot, {
       ...defaultOrphanDirScanDeps,
       listDirs: (root) => worktreeScanDirs(root, primaryRepoRoot, defaultOrphanDirScanDeps.listDirs, isRepoCheckoutDir)
@@ -26227,8 +26936,8 @@ ${err.stderr ?? ""}`;
 }
 
 // src/issue-commands.ts
-var import_node_fs32 = require("node:fs");
-var import_node_crypto5 = require("node:crypto");
+var import_node_fs35 = require("node:fs");
+var import_node_crypto6 = require("node:crypto");
 var ghRunner = async (args, timeoutMs) => (await execFileP2("gh", args, { timeout: timeoutMs })).stdout;
 var ReparentConflictError = class extends Error {
   constructor(message, payload) {
@@ -26245,7 +26954,7 @@ async function editIssue(client, options, deps = {}) {
   const url = `https://github.com/${repo}/issues/${parsed.number}`;
   const patch = {};
   let bodyChanged = false;
-  const textDeps = () => deps.textDeps ?? { readFile: (p, e) => Promise.resolve((0, import_node_fs32.readFileSync)(p, e)), readStdin: () => Promise.resolve("") };
+  const textDeps = () => deps.textDeps ?? { readFile: (p, e) => Promise.resolve((0, import_node_fs35.readFileSync)(p, e)), readStdin: () => Promise.resolve("") };
   if (options.titleFile !== void 0) {
     patch.title = await resolveIssueTitle({ title: options.title, titleFile: options.titleFile }, textDeps());
   } else if (options.title !== void 0) {
@@ -26478,7 +27187,7 @@ function rowIdempotencyKey(batchKey, spec) {
   const identity = `${spec.type}
 ${spec.title.trim()}
 ${spec.body ?? ""}`;
-  const hash = (0, import_node_crypto5.createHash)("sha256").update(identity).digest("hex").slice(0, 16);
+  const hash = (0, import_node_crypto6.createHash)("sha256").update(identity).digest("hex").slice(0, 16);
   return `${batchKey}:${hash}`;
 }
 var BATCH_SPEC_KEYS = /* @__PURE__ */ new Set(["type", "title", "body", "priority", "labels", "label", "parent", "repo", "surface"]);
@@ -26808,7 +27517,7 @@ function extendCreateCommand(issue2, batchAttach) {
     if (opts.batch) {
       let specs;
       try {
-        const raw = (0, import_node_fs32.readFileSync)(opts.batch, "utf8");
+        const raw = (0, import_node_fs35.readFileSync)(opts.batch, "utf8");
         specs = JSON.parse(raw);
         if (!Array.isArray(specs)) throw new Error("batch file must contain a JSON array");
       } catch (e) {
@@ -26882,8 +27591,8 @@ ${lines}`, {
 }
 
 // src/train-commands.ts
-var import_node_fs33 = require("node:fs");
-var import_node_path32 = require("node:path");
+var import_node_fs36 = require("node:fs");
+var import_node_path35 = require("node:path");
 
 // src/train-status.ts
 function buildTrainStatusReport(input) {
@@ -26923,7 +27632,7 @@ function formatTrainStatus(r) {
 // src/train-commands.ts
 function readRepoVersion() {
   try {
-    return JSON.parse((0, import_node_fs33.readFileSync)((0, import_node_path32.join)(process.cwd(), ".claude-plugin", "plugin.json"), "utf8")).version || void 0;
+    return JSON.parse((0, import_node_fs36.readFileSync)((0, import_node_path35.join)(process.cwd(), ".claude-plugin", "plugin.json"), "utf8")).version || void 0;
   } catch {
     return void 0;
   }
@@ -27069,9 +27778,9 @@ function registerDeployCommands(program3) {
 }
 
 // src/discovery-commands.ts
-var import_node_fs34 = require("node:fs");
-var import_node_os12 = require("node:os");
-var import_node_path33 = require("node:path");
+var import_node_fs37 = require("node:fs");
+var import_node_os13 = require("node:os");
+var import_node_path36 = require("node:path");
 var GC_GH_TIMEOUT_MS3 = 2e4;
 async function collectStatus() {
   const repo = await resolveRepo();
@@ -27247,10 +27956,10 @@ async function collectOnboardStatus() {
     else if (top) nextCommand = `mmi-cli board claim ${top.number}  # ${top.title}`;
     else nextCommand = "mmi-cli board read \u2014 no claimable items found";
   }
-  const home = (0, import_node_os12.homedir)();
+  const home = (0, import_node_os13.homedir)();
   const plugin = onboardPluginGate({
-    readKnown: () => readFileSyncSafe((0, import_node_path33.join)(home, ...KNOWN_MARKETPLACES_RELATIVE), import_node_fs34.readFileSync),
-    readSettings: () => readFileSyncSafe((0, import_node_path33.join)(home, ".claude", "settings.json"), import_node_fs34.readFileSync)
+    readKnown: () => readFileSyncSafe((0, import_node_path36.join)(home, ...KNOWN_MARKETPLACES_RELATIVE), import_node_fs37.readFileSync),
+    readSettings: () => readFileSyncSafe((0, import_node_path36.join)(home, ".claude", "settings.json"), import_node_fs37.readFileSync)
   });
   return { track, board, registry: registry2, secrets, plugin, nextCommand };
 }
@@ -27313,6 +28022,7 @@ var LOOP_PLAYBOOKS = {
     title: "Agent",
     steps: [
       { label: "Orient in the current repository", command: "mmi-cli onboard" },
+      { label: "Structure search via Hub cloud (paths/symbols/meaning) before grepping docs/", command: "mmi-cli repo-index search <q>" },
       { label: "Read the next board item", command: "mmi-cli board read" },
       { label: "Claim it and create an isolated worktree", command: "mmi-cli worktree create <issue-number> --claim --from origin/development" },
       { label: "Build and test in the touched package", command: "npm test && npm run build" },
@@ -28858,7 +29568,8 @@ function diagnoseSurface(evidence) {
     return { ...base, state: "repair-failed", repairDetail: evidence.repair.detail };
   }
   if (evidence.repair?.attempted && evidence.repair.ok) {
-    return { ...base, state: "clean", repairDetail: evidence.repair.detail };
+    const behindReleased = evidence.installedVersion && evidence.releasedVersion && compareVersions(evidence.installedVersion, evidence.releasedVersion) < 0;
+    return { ...base, state: behindReleased ? "pending-reload" : "clean", repairDetail: evidence.repair.detail };
   }
   if (!evidence.installRecordPresent) return { ...base, state: "missing" };
   if (!evidence.deliveryPresent || !evidence.payloadPresent || evidence.manifest === "missing") {
@@ -28876,7 +29587,7 @@ function reloadInstruction(descriptor) {
   return `${verb} ${descriptor.displayName}`;
 }
 function planSurfaceRepair(diagnosis) {
-  if (diagnosis.state === "clean" || diagnosis.state === "skipped" || diagnosis.state === "freshness-unknown") return null;
+  if (diagnosis.state === "clean" || diagnosis.state === "pending-reload" || diagnosis.state === "skipped" || diagnosis.state === "freshness-unknown") return null;
   const descriptor = diagnosis.descriptor;
   if (descriptor.repairOwner !== "mmi-cli") {
     return {
@@ -28901,6 +29612,7 @@ function buildSurfaceDoctorCheck(diagnosis) {
   const detailByState = {
     skipped: "skipped \u2014 host not active",
     clean: diagnosis.repairDetail ? `clean \u2014 repaired and verified (${diagnosis.repairDetail})` : `clean${versions ? ` \u2014 ${versions}` : ""}`,
+    "pending-reload": `pending ${descriptor.reload === "workspace" ? "reload" : "restart"} \u2014 repaired to ${diagnosis.releasedVersion}, but ${diagnosis.installedVersion} is still the version this host has loaded${diagnosis.repairDetail ? ` (${diagnosis.repairDetail})` : ""}`,
     "freshness-unknown": `${diagnosis.installedVersion ?? "installed"} \u2014 freshness UNKNOWN, the published version could not be read`,
     stale: `stale${versions ? ` \u2014 ${versions}` : ""}`,
     missing: "missing \u2014 no install record",
@@ -28912,11 +29624,14 @@ function buildSurfaceDoctorCheck(diagnosis) {
     id: `${descriptor.token}-plugin`,
     surface: descriptor.token,
     state,
-    ok: state === "clean" || state === "skipped",
+    ok: state === "clean" || state === "skipped" || state === "pending-reload",
     ...state === "freshness-unknown" ? { reportOnly: true } : {},
+    // Nothing is broken, so this is not a ✗ — but it is the one OK row an operator must act on, and the
+    // short default lane and the SessionStart banner both filter to failures unless a row says otherwise.
+    ...state === "pending-reload" ? { warn: true } : {},
     label: `${descriptor.displayName} plugin`,
     detail: detailByState[state],
-    ...plan ? { fix: plan.instruction } : state === "freshness-unknown" ? { fix: "check `mmi-cli --version` against `npm view @mutmutco/cli version`, then rerun doctor" } : {},
+    ...plan ? { fix: plan.instruction } : state === "pending-reload" ? { fix: reloadInstruction(descriptor) } : state === "freshness-unknown" ? { fix: "check `mmi-cli --version` against `npm view @mutmutco/cli version`, then rerun doctor" } : {},
     verbose: [
       // The three numbers the legacy builder used to print. They belong here now that this is the only
       // plugin row, and a report that names a state without naming the versions behind it is not evidence.
@@ -29197,6 +29912,102 @@ function checkDocsIndex(probe) {
     verbose: evidence
   };
 }
+function checkRepoIndexCloud(probe) {
+  if (!probe) return null;
+  const evidence = [
+    probe.repo ? `repo: ${probe.repo}` : "repo: (estate)",
+    probe.builtAt ? `builtAt: ${probe.builtAt}` : "builtAt: n/a",
+    typeof probe.fileCount === "number" ? `fileCount: ${probe.fileCount}` : "fileCount: n/a",
+    typeof probe.embCount === "number" ? `embCount: ${probe.embCount}` : "embCount: n/a",
+    typeof probe.localPresent === "boolean" ? `local cache: ${probe.localPresent ? "present" : "absent"}` : "local cache: n/a"
+  ];
+  switch (probe.kind) {
+    case "healthy":
+      return {
+        ok: true,
+        id: "repo-index",
+        label: "repo-index",
+        detail: probe.detail ?? `cloud ok${typeof probe.fileCount === "number" ? ` \u2014 ${probe.fileCount} files` : ""}`,
+        verbose: evidence
+      };
+    case "command-absent":
+      return {
+        ok: false,
+        id: "repo-index",
+        label: "repo-index",
+        detail: "this mmi-cli build has no repo-index command",
+        fix: "run `mmi-cli doctor` to heal the global CLI, or `npm install -g @mutmutco/cli`",
+        verbose: evidence
+      };
+    case "deploy-lag":
+      return {
+        ok: false,
+        id: "repo-index",
+        label: "repo-index",
+        detail: "Hub /repo-index/* not deployed yet (HTTP 404)",
+        fix: "ship a Hub release carrying estate index routes, then run repo-index-reconcile",
+        reportOnly: true,
+        verbose: evidence
+      };
+    case "missing-projection":
+      return {
+        ok: false,
+        id: "repo-index",
+        label: "repo-index",
+        detail: probe.detail ?? "no cloud projection for this repo",
+        fix: "run harbour repo-index-reconcile or `mmi-cli repo-index sync-estate --repo <owner/name>`",
+        verbose: evidence
+      };
+    case "stale":
+      return {
+        ok: false,
+        id: "repo-index",
+        label: "repo-index",
+        detail: probe.detail ?? "cloud projection looks stale vs recent pushes",
+        fix: "trigger `repo-index-reconcile` (workflow_dispatch) or wait for the 6h harbour tick",
+        verbose: evidence
+      };
+    case "auth":
+      return {
+        ok: false,
+        id: "repo-index",
+        label: "repo-index",
+        detail: "Hub session missing or unauthorized for repo-index",
+        fix: "run `gh auth login` and ensure a Hub session exists (`mmi-cli whoami`)",
+        verbose: evidence
+      };
+    case "config":
+      return {
+        ok: false,
+        id: "repo-index",
+        label: "repo-index",
+        detail: probe.detail ?? "Hub API URL not configured",
+        fix: "run `mmi-cli doctor` to repair Hub wiring",
+        verbose: evidence
+      };
+    case "network":
+      return {
+        ok: false,
+        id: "repo-index",
+        label: "repo-index",
+        detail: probe.detail ?? "could not reach Hub repo-index",
+        fix: "retry when the network is up; structure search stays fail-soft",
+        reportOnly: true,
+        verbose: evidence
+      };
+    case "local-advisory":
+      return {
+        ok: true,
+        id: "repo-index",
+        label: "repo-index",
+        detail: probe.detail ?? "local cache absent (cloud search does not need it)",
+        warn: true,
+        verbose: evidence
+      };
+    default:
+      return null;
+  }
+}
 function planGitignore(current) {
   const { content, changed } = upsertManagedGitignoreBlock(current);
   return changed ? { ok: false, content } : { ok: true };
@@ -29386,6 +30197,36 @@ async function runDoctorClean(opts, io, deps) {
     const docs2 = checkDocsIndex(probe);
     if (docs2) emitNow(docs2);
   }
+  async function runRepoIndexRow() {
+    if (lane.preflight && !opts.self && !lane.full) {
+      emitNow({
+        ok: true,
+        id: "repo-index",
+        label: "repo-index",
+        detail: "command present on this CLI (cloud probe skipped on --preflight)",
+        verbose: ["preflight lane: no Hub network"]
+      });
+      return;
+    }
+    let probe;
+    try {
+      probe = await deps.repoIndexCloudState(await deps.repoRoot());
+    } catch (e) {
+      const message = e instanceof Error ? e.message : String(e);
+      emitNow({
+        ok: false,
+        id: "repo-index",
+        label: "repo-index",
+        detail: `could not be read \u2014 ${message}`,
+        fix: "repair Hub session / network, then re-run doctor",
+        reportOnly: true,
+        verbose: [`probe threw: ${message}`]
+      });
+      return;
+    }
+    const row = checkRepoIndexCloud(probe);
+    if (row) emitNow(row);
+  }
   async function runHousekeeperRows() {
     const repoRoot2 = await deps.repoRoot();
     try {
@@ -29459,6 +30300,8 @@ async function runDoctorClean(opts, io, deps) {
     // A `docs/` tree walk plus one batched `git check-ignore` — cheap next to the two rows below it, but a
     // disk walk and a subprocess all the same, so full lane only (#4091).
     { id: "docs-index", when: isOrgRepo && lane.full, run: runDocsIndexRow },
+    // Hub cloud probe (short timeout). Full lane + `--self`; `--preflight` may emit command-absent only (#4156).
+    { id: "repo-index", when: isOrgRepo && (lane.full || Boolean(opts.self) || lane.preflight), run: runRepoIndexRow },
     // The two most expensive things in this file — a real `git fetch` plus train-branch fast-forward,
     // and a `gh`-backed gc sweep with a 20s timeout — so org repos on the full lane only (#3485).
     { id: "train-branches", when: isOrgRepo && lane.full, run: runTrainSyncRow },
@@ -29516,18 +30359,18 @@ function parseOriginRepo(remoteUrl) {
   return `${match[1]}/${match[2]}`;
 }
 function ghHostsConfigPath(env, platform2) {
-  const sep2 = platform2 === "win32" ? "\\" : "/";
-  const join31 = (...parts) => parts.join(sep2);
+  const sep3 = platform2 === "win32" ? "\\" : "/";
+  const join34 = (...parts) => parts.join(sep3);
   const explicit = env.GH_CONFIG_DIR?.trim();
-  if (explicit) return join31(explicit, "hosts.yml");
+  if (explicit) return join34(explicit, "hosts.yml");
   if (platform2 === "win32") {
     const appData = (env.AppData ?? env.APPDATA)?.trim();
-    return appData ? join31(appData, "GitHub CLI", "hosts.yml") : void 0;
+    return appData ? join34(appData, "GitHub CLI", "hosts.yml") : void 0;
   }
   const xdg = env.XDG_CONFIG_HOME?.trim();
-  if (xdg) return join31(xdg, "gh", "hosts.yml");
+  if (xdg) return join34(xdg, "gh", "hosts.yml");
   const home = env.HOME?.trim();
-  return home ? join31(home, ".config", "gh", "hosts.yml") : void 0;
+  return home ? join34(home, ".config", "gh", "hosts.yml") : void 0;
 }
 function parseGhHostsAccounts(yaml, host = "github.com") {
   let hostIndent = null;
@@ -29577,17 +30420,17 @@ function ghAccountCaveat(announcedLogin, accounts) {
 }
 
 // src/doctor-io.ts
-var import_node_fs35 = require("node:fs");
-var import_node_os13 = require("node:os");
-var import_node_path34 = require("node:path");
-var import_node_child_process15 = require("node:child_process");
+var import_node_fs38 = require("node:fs");
+var import_node_os14 = require("node:os");
+var import_node_path37 = require("node:path");
+var import_node_child_process17 = require("node:child_process");
 var import_node_util8 = require("node:util");
-var execFileP6 = (0, import_node_util8.promisify)(import_node_child_process15.execFile);
+var execFileP6 = (0, import_node_util8.promisify)(import_node_child_process17.execFile);
 var MMI_PLUGIN_ID2 = "mmi@mutmutco";
 function installedClaudePluginVersion() {
   try {
     const file = JSON.parse(
-      (0, import_node_fs35.readFileSync)((0, import_node_path34.join)((0, import_node_os13.homedir)(), ".claude", "plugins", "installed_plugins.json"), "utf8")
+      (0, import_node_fs38.readFileSync)((0, import_node_path37.join)((0, import_node_os14.homedir)(), ".claude", "plugins", "installed_plugins.json"), "utf8")
     );
     const versions = (file.plugins?.[MMI_PLUGIN_ID2] ?? []).map((r) => r.version).filter((v) => Boolean(v));
     if (versions.length === 0) return void 0;
@@ -29598,7 +30441,7 @@ function installedClaudePluginVersion() {
 }
 function manifestVersion(path2) {
   try {
-    const manifest = JSON.parse((0, import_node_fs35.readFileSync)(path2, "utf8"));
+    const manifest = JSON.parse((0, import_node_fs38.readFileSync)(path2, "utf8"));
     return typeof manifest.version === "string" && manifest.version.trim() ? manifest.version.trim() : void 0;
   } catch {
     return void 0;
@@ -29608,27 +30451,27 @@ function installedSurfacePluginVersion(surface) {
   const token = surfaceToken(surface);
   if (token === "kilo") {
     try {
-      const stamp = (0, import_node_fs35.readFileSync)((0, import_node_path34.join)((0, import_node_os13.homedir)(), ".kilo", ".mmi-kilo-version"), "utf8").trim();
+      const stamp = (0, import_node_fs38.readFileSync)((0, import_node_path37.join)((0, import_node_os14.homedir)(), ".kilo", ".mmi-kilo-version"), "utf8").trim();
       return stamp || void 0;
     } catch {
       return void 0;
     }
   }
   if (token === "cursor") {
-    return manifestVersion((0, import_node_path34.join)(cursorLocalPluginRoot(), ".cursor-plugin", "plugin.json"));
+    return manifestVersion((0, import_node_path37.join)(cursorLocalPluginRoot(), ".cursor-plugin", "plugin.json"));
   }
   if (token === "kimi") {
-    return manifestVersion((0, import_node_path34.join)(surfaceConfigRoot(surface), "plugins", "managed", "mmi", ".kimi-plugin", "plugin.json"));
+    return manifestVersion((0, import_node_path37.join)(surfaceConfigRoot(surface), "plugins", "managed", "mmi", ".kimi-plugin", "plugin.json"));
   }
   if (token === "claude") return installedClaudePluginVersion();
   if (token !== "codex") return void 0;
   try {
-    const raw = process.platform === "win32" ? (0, import_node_child_process15.execFileSync)("cmd.exe", ["/c", "codex", "plugin", "list", "--json"], {
+    const raw = process.platform === "win32" ? (0, import_node_child_process17.execFileSync)("cmd.exe", ["/c", "codex", "plugin", "list", "--json"], {
       encoding: "utf8",
       stdio: ["ignore", "pipe", "ignore"],
       timeout: 15e3,
       windowsHide: true
-    }) : (0, import_node_child_process15.execFileSync)("codex", ["plugin", "list", "--json"], {
+    }) : (0, import_node_child_process17.execFileSync)("codex", ["plugin", "list", "--json"], {
       encoding: "utf8",
       stdio: ["ignore", "pipe", "ignore"],
       timeout: 15e3,
@@ -29646,7 +30489,7 @@ function installedActivePluginVersion(surface = detectSurface(process.env)) {
 }
 function worktreeRootSync() {
   try {
-    const out = (0, import_node_child_process15.execFileSync)("git", ["rev-parse", "--show-toplevel"], { windowsHide: true, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] });
+    const out = (0, import_node_child_process17.execFileSync)("git", ["rev-parse", "--show-toplevel"], { windowsHide: true, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] });
     let root = out.endsWith("\n") ? out.slice(0, -1) : out;
     if (process.platform === "win32" && root.endsWith("\r")) root = root.slice(0, -1);
     return root || null;
@@ -29656,13 +30499,13 @@ function worktreeRootSync() {
 }
 var gitignorePath = () => {
   const root = worktreeRootSync();
-  return root === null ? null : (0, import_node_path34.join)(root, ".gitignore");
+  return root === null ? null : (0, import_node_path37.join)(root, ".gitignore");
 };
 function readGitignore() {
   const path2 = gitignorePath();
   if (path2 === null) return null;
   try {
-    return (0, import_node_fs35.readFileSync)(path2, "utf8");
+    return (0, import_node_fs38.readFileSync)(path2, "utf8");
   } catch {
     return null;
   }
@@ -29671,7 +30514,7 @@ function writeGitignore(content) {
   const path2 = gitignorePath();
   if (path2 === null) return false;
   try {
-    (0, import_node_fs35.writeFileSync)(path2, content, "utf8");
+    (0, import_node_fs38.writeFileSync)(path2, content, "utf8");
     return true;
   } catch {
     return false;
@@ -29695,7 +30538,7 @@ async function repoRoot() {
 }
 function hasRepoLocalWorktrees() {
   const root = worktreeRootSync();
-  return root !== null && (0, import_node_fs35.existsSync)((0, import_node_path34.join)(root, ".worktrees"));
+  return root !== null && (0, import_node_fs38.existsSync)((0, import_node_path37.join)(root, ".worktrees"));
 }
 
 // src/index.ts
@@ -29731,8 +30574,8 @@ ${r.stderr ?? ""}`).catch(() => "");
 function ghMultiAccountCaveat(announcedLogin) {
   try {
     const hostsPath = ghHostsConfigPath(process.env, process.platform);
-    if (!hostsPath || !(0, import_node_fs36.existsSync)(hostsPath)) return void 0;
-    return ghAccountCaveat(announcedLogin, parseGhHostsAccounts((0, import_node_fs36.readFileSync)(hostsPath, "utf8")));
+    if (!hostsPath || !(0, import_node_fs39.existsSync)(hostsPath)) return void 0;
+    return ghAccountCaveat(announcedLogin, parseGhHostsAccounts((0, import_node_fs39.readFileSync)(hostsPath, "utf8")));
   } catch {
     return void 0;
   }
@@ -29740,20 +30583,20 @@ function ghMultiAccountCaveat(announcedLogin) {
 var ENV_HEAL_LOCK_STALE_MS = 10 * 6e4;
 var ENV_HEAL_LOCK_MAX_WAIT_MS = 2 * 6e4;
 function envHealLockPath(home) {
-  return (0, import_node_path35.join)(home, ".claude", "plugins", ".mmi-env-heal.lock");
+  return (0, import_node_path38.join)(home, ".claude", "plugins", ".mmi-env-heal.lock");
 }
 async function withEnvHealLock(what, run) {
   try {
     return await withFileLock(
-      envHealLockPath((0, import_node_os14.homedir)()),
+      envHealLockPath((0, import_node_os15.homedir)()),
       { staleMs: ENV_HEAL_LOCK_STALE_MS, maxWaitMs: ENV_HEAL_LOCK_MAX_WAIT_MS, label: "mmi env-heal lock" },
       run
     );
   } catch (e) {
     if (e instanceof FileLockBusyError) {
-      return { ok: false, skipped: true, detail: `${what} skipped \u2014 ${e.message}` };
+      return { ok: false, skipped: true, detail: `${what} skipped ? ${e.message}` };
     }
-    return { ok: false, detail: `${what} could not take the env-heal lock \u2014 ${e.message}` };
+    return { ok: false, detail: `${what} could not take the env-heal lock ? ${e.message}` };
   }
 }
 function throttledReleasedVersion() {
@@ -29809,13 +30652,13 @@ function mmiDoctorDeps(opts = {}) {
     pluginTrustState: () => codexHookTrustState(),
     releasedVersion: throttled ? throttled.read : fetchNpmReleasedVersion,
     releasedVersionNote: throttled ? throttled.note : void 0,
-    // #3272: the --apply self-heal for a stale running CLI — npm global, shadows any plugin shim (#2879).
+    // #3272: the --apply self-heal for a stale running CLI ? npm global, shadows any plugin shim (#2879).
     // #3489: serialised. Both heals mutate machine-global state (the npm global prefix; the Claude
     // marketplace clone + plugin cache) and neither is idempotent under concurrency. They share ONE lock
     // rather than one each, because they are not independent: the plugin heal reinstalls a bundle that
     // carries a CLI shim, so a concurrent npm global install races the same PATH surface.
     updateCli: (target, onStep) => withEnvHealLock("npm global CLI self-update", () => npmSelfUpdateCli(target, onStep)),
-    // #3282: the --apply self-heal for a stale/unresolved Claude plugin — the same marketplace reinstall
+    // #3282: the --apply self-heal for a stale/unresolved Claude plugin ? the same marketplace reinstall
     // `mmi-cli plugin heal` drives. Takes effect on the next Claude reload, so the row asks for a restart.
     healPlugin: (onStep) => {
       const surface = detectSurface(process.env);
@@ -29833,7 +30676,7 @@ function mmiDoctorDeps(opts = {}) {
     // #2759: same fetch+ff-only sync SessionStart runs, wired here too so an on-demand `mmi-cli doctor`
     // self-heals a checkout a long-running session left stale.
     syncTrain: () => syncLocalTrainBranches(execFileGitRun),
-    // #2903: doctor DETECTS stale cached plugin versions and defers the delete to `plugin-prune` — it never
+    // #2903: doctor DETECTS stale cached plugin versions and defers the delete to `plugin-prune` ? it never
     // writes to the harness-owned cache itself. Same plan builder the verb uses, so the two never disagree.
     // No `withBytes` here: doctor runs on EVERY SessionStart, and sizing means recursively stat'ing every
     // stale version tree. The count comes from one cheap readdir; `plugin-prune` reports the MB.
@@ -29842,7 +30685,7 @@ function mmiDoctorDeps(opts = {}) {
       const configRoot = surfaceConfigRoot(surface);
       const running = surface === "codex" ? installedActivePluginVersion(surface) : runningPluginVersion(process.env, resolveClientVersion());
       const plan = buildPluginCachePlan(
-        (0, import_node_os14.homedir)(),
+        (0, import_node_os15.homedir)(),
         running,
         pluginCacheFsDeps(configRoot, () => 0),
         { configRoot, includeStaging: surface !== "codex" }
@@ -29856,24 +30699,24 @@ function mmiDoctorDeps(opts = {}) {
       };
     },
     // #3470: what the SessionStart hook LAST emitted, measured at emission by the session-start verb below.
-    // A local record read — cheap enough for every lane, including the banner.
+    // A local record read ? cheap enough for every lane, including the banner.
     sessionPayload: () => readSessionPayload(process.cwd()),
-    // #3485 items 9 and 8: why the MMI plugin has never printed an "updated — please restart" notice, and
+    // #3485 items 9 and 8: why the MMI plugin has never printed an "updated ? please restart" notice, and
     // which branch it would pick one up from. Two local file reads, no network, fail-soft to no rows.
     marketplaceRows: () => {
       try {
         if (detectSurface(process.env) === "codex") return [];
-        const home = (0, import_node_os14.homedir)();
+        const home = (0, import_node_os15.homedir)();
         const rows = marketplaceRows(
           MMI_MARKETPLACE_NAME,
-          readFileSyncSafe((0, import_node_path35.join)(home, ...KNOWN_MARKETPLACES_RELATIVE), import_node_fs36.readFileSync),
-          readFileSyncSafe((0, import_node_path35.join)(home, ".claude", "settings.json"), import_node_fs36.readFileSync),
+          readFileSyncSafe((0, import_node_path38.join)(home, ...KNOWN_MARKETPLACES_RELATIVE), import_node_fs39.readFileSync),
+          readFileSyncSafe((0, import_node_path38.join)(home, ".claude", "settings.json"), import_node_fs39.readFileSync),
           // #3974: this CLI heals these rows, so report mode names the doctor run rather than the hand
-          // edit. Unconditional — it is a fact about mmi-cli, not about the lane this run is on.
+          // edit. Unconditional ? it is a fact about mmi-cli, not about the lane this run is on.
           true
         );
         const pending = readMarketplacePinPending(
-          (0, import_node_path35.join)(home, ".claude", "plugins", ".mmi-marketplace-pin-pending.json"),
+          (0, import_node_path38.join)(home, ".claude", "plugins", ".mmi-marketplace-pin-pending.json"),
           MMI_MARKETPLACE_NAME
         );
         if (!pending) return rows;
@@ -29884,7 +30727,7 @@ function mmiDoctorDeps(opts = {}) {
             ...rest,
             ok: true,
             warn: true,
-            detail: `pending restart \u2014 doctor pinned main at ${pending.at}; restart Claude Code to load it`,
+            detail: `pending restart ? doctor pinned main at ${pending.at}; restart Claude Code to load it`,
             verbose: [...row.verbose ?? [], "known_marketplaces.json was rewritten by the running Claude host after the verified doctor write"]
           };
         });
@@ -29892,16 +30735,16 @@ function mmiDoctorDeps(opts = {}) {
         return [];
       }
     },
-    // #3974: the heal behind those rows, under --apply only. Same Codex carve-out as the rows above —
+    // #3974: the heal behind those rows, under --apply only. Same Codex carve-out as the rows above ?
     // Codex keeps its registration in config.toml, so there is no ~/.claude registration to pin.
     healMarketplacePins: () => {
       try {
         if (detectSurface(process.env) === "codex") return void 0;
-        const home = (0, import_node_os14.homedir)();
+        const home = (0, import_node_os15.homedir)();
         const names = [MMI_MARKETPLACE_NAME];
-        const result = applyOrgMarketplacePins((0, import_node_path35.join)(home, ...KNOWN_MARKETPLACES_RELATIVE), names);
+        const result = applyOrgMarketplacePins((0, import_node_path38.join)(home, ...KNOWN_MARKETPLACES_RELATIVE), names);
         if (result?.wrote) {
-          writeMarketplacePinPending((0, import_node_path35.join)(home, ".claude", "plugins", ".mmi-marketplace-pin-pending.json"), names);
+          writeMarketplacePinPending((0, import_node_path38.join)(home, ".claude", "plugins", ".mmi-marketplace-pin-pending.json"), names);
         }
         return result;
       } catch {
@@ -29909,20 +30752,73 @@ function mmiDoctorDeps(opts = {}) {
       }
     },
     // #4091: the same `docs index --check` comparison the required CI gate runs, in-process. Rooted at the
-    // repo root doctor already resolved — never `process.cwd()`, which would have `mmi-cli doctor` run from
+    // repo root doctor already resolved ? never `process.cwd()`, which would have `mmi-cli doctor` run from
     // `cli/` measure a `cli/docs/` tree that does not exist.
     //
     // `existsSync` on `docs/index.md` is the adoption gate, and it sits UNDER the table's org-repo gate
     // rather than replacing it: a missing index is drift by construction, so without this a repo that never
     // adopted the generated routing index (MMG-Unlive: `docs/Archive/**` only, no index, no gate.yml) would
-    // get a permanent ✗ demanding an artifact it never asked for.
+    // get a permanent ? demanding an artifact it never asked for.
     docsIndexState: (root) => {
-      if (!(0, import_node_fs36.existsSync)((0, import_node_path35.join)(root, DOCS_INDEX_PATH))) return void 0;
+      if (!(0, import_node_fs39.existsSync)((0, import_node_path38.join)(root, DOCS_INDEX_PATH))) return void 0;
       const real = createDocsIndexDeps(root);
       let docs2;
       const listDocs = () => docs2 ??= real.listDocs();
       const drift = docsIndex({ ...real, listDocs }, { check: true }).drift;
       return { drift, docCount: listDocs().length };
+    },
+    // #4156: short-timeout Hub status for the current repo. Fail-soft ? never throws to doctor.
+    repoIndexCloudState: async (root) => {
+      const local = repoIndexStatus(root);
+      try {
+        const cfg = await loadConfig();
+        const repo = inferRepoSlug(root);
+        const st = await statusRepoIndexCloud(repo, {
+          ...registryClientDeps(cfg),
+          timeoutMs: 4e3
+        });
+        if (isRepoIndexStatusError(st)) {
+          if (st.code === "deploy-lag") return { kind: "deploy-lag", repo, localPresent: local.present };
+          if (st.code === "auth") return { kind: "auth", repo, localPresent: local.present };
+          if (st.code === "config") return { kind: "config", repo, detail: st.error, localPresent: local.present };
+          return { kind: "network", repo, detail: st.error, localPresent: local.present };
+        }
+        const present = st.present;
+        const builtAt = typeof st.builtAt === "string" ? st.builtAt : void 0;
+        const fileCount = typeof st.fileCount === "number" ? st.fileCount : void 0;
+        const embCount = typeof st.embCount === "number" ? st.embCount : void 0;
+        if (present === false) {
+          return { kind: "missing-projection", repo, localPresent: local.present, fileCount: 0, embCount: 0 };
+        }
+        if (builtAt) {
+          const ageMs = Date.now() - Date.parse(builtAt);
+          if (Number.isFinite(ageMs) && ageMs > 48 * 60 * 60 * 1e3) {
+            return {
+              kind: "stale",
+              repo,
+              builtAt,
+              fileCount,
+              embCount,
+              localPresent: local.present,
+              detail: `projection builtAt ${builtAt} (>48h old)`
+            };
+          }
+        }
+        return {
+          kind: "healthy",
+          repo: typeof st.repo === "string" ? st.repo : repo,
+          builtAt,
+          fileCount,
+          embCount,
+          localPresent: local.present
+        };
+      } catch (e) {
+        return {
+          kind: "network",
+          detail: e instanceof Error ? e.message : String(e),
+          localPresent: local.present
+        };
+      }
     }
   };
 }
@@ -29970,7 +30866,7 @@ function argvWantsJson2() {
 var unknownFlagJsonHandled = false;
 var PARSE_HINT_SENTINEL = "@@mmi-parse-hint@@";
 var DISCOVERY_HINT = "run `mmi-cli commands` for the agentic-coding map, `mmi-cli explain <command>` for detail, or `mmi-cli commands --json --primary` for machine discovery";
-var STALE_HINT = `(${DISCOVERY_HINT}). If you expected this command to exist, your installed mmi-cli may be stale \u2014 update it (see: mmi-cli doctor)`;
+var STALE_HINT = `(${DISCOVERY_HINT}). If you expected this command to exist, your installed mmi-cli may be stale ? update it (see: mmi-cli doctor)`;
 var lastParseErrorKind = "other";
 var lastUnknownCommand;
 function classifyParseError(plain) {
@@ -30036,7 +30932,7 @@ function resolveParseHint() {
   const path2 = commandPath2(cmd);
   return [
     `Usage: mmi-cli ${path2} ${cmd.usage()}`,
-    "This command exists and your mmi-cli is not the problem \u2014 the ARGUMENTS did not parse.",
+    "This command exists and your mmi-cli is not the problem ? the ARGUMENTS did not parse.",
     `Run \`mmi-cli ${path2} --help\` for its signature, \`mmi-cli explain ${path2}\` for detail, or \`mmi-cli commands\` for the full map.`
   ].join("\n");
 }
@@ -30097,7 +30993,7 @@ function envelopeAwareWriteErr(str) {
   process.stderr.write(str);
 }
 var program2 = new Command();
-program2.name("mmi-cli").description("MMI Future Hub CLI \u2014 the org control plane for agentic coding.").version(resolveClientVersion()).configureOutput({ writeErr: envelopeAwareWriteErr }).showHelpAfterError(PARSE_HINT_SENTINEL);
+program2.name("mmi-cli").description("MMI Future Hub CLI ? the org control plane for agentic coding.").version(resolveClientVersion()).configureOutput({ writeErr: envelopeAwareWriteErr }).showHelpAfterError(PARSE_HINT_SENTINEL);
 function appActorDeps() {
   return {
     fetchSecret: async (key) => fetchSecretValue(makeSecretsDeps(await loadConfig()), key, { repo: APP_VAULT_REPO }),
@@ -30129,19 +31025,19 @@ program2.hook("preAction", async (_thisCommand, actionCommand) => {
 });
 var rules = program2.command("rules").description("org-managed .gitignore delivery");
 rules.command("gitignore").option("--write", "upsert the managed block into .gitignore (default: check only, non-zero exit on drift)").option("--json", "machine-readable output").description("verify (or --write) this repo's org-managed .gitignore block matches the SSOT").action((opts) => {
-  const path2 = (0, import_node_path35.join)(process.cwd(), ".gitignore");
-  const current = (0, import_node_fs36.existsSync)(path2) ? (0, import_node_fs36.readFileSync)(path2, "utf8") : null;
+  const path2 = (0, import_node_path38.join)(process.cwd(), ".gitignore");
+  const current = (0, import_node_fs39.existsSync)(path2) ? (0, import_node_fs39.readFileSync)(path2, "utf8") : null;
   const plan = planManagedGitignore(current);
   const drift = [...plan.added.map((l) => `+${l}`), ...plan.removed.map((l) => `-${l}`)].join(", ") || "block normalize";
   if (opts.json) {
-    if (opts.write && plan.changed) (0, import_node_fs36.writeFileSync)(path2, plan.content, "utf8");
+    if (opts.write && plan.changed) (0, import_node_fs39.writeFileSync)(path2, plan.content, "utf8");
     console.log(JSON.stringify(plan, null, 2));
     if (!opts.write && plan.changed) process.exitCode = 1;
     return;
   }
   if (opts.write) {
     if (plan.changed) {
-      (0, import_node_fs36.writeFileSync)(path2, plan.content, "utf8");
+      (0, import_node_fs39.writeFileSync)(path2, plan.content, "utf8");
       console.log(`mmi-cli org rules gitignore: updated .gitignore (${drift})`);
     } else {
       console.log("mmi-cli org rules gitignore: up to date");
@@ -30149,7 +31045,7 @@ rules.command("gitignore").option("--write", "upsert the managed block into .git
     return;
   }
   if (plan.changed) {
-    console.error(`mmi-cli org rules gitignore: managed block drift (${drift}) \u2014 run \`mmi-cli org rules gitignore --write\` and commit`);
+    console.error(`mmi-cli org rules gitignore: managed block drift (${drift}) ? run \`mmi-cli org rules gitignore --write\` and commit`);
     process.exitCode = 1;
   } else {
     console.log("mmi-cli org rules gitignore: up to date");
@@ -30255,7 +31151,7 @@ wave.command("land").description("serial merge open PRs to development with reba
 });
 var gcCmd = program2.command("gc").description("dry-run cleanup for merged/closed PR local+remote branches, linked worktrees, stale tracking refs, and worktree metadata (--scratch: safe local scratch + confirmed-synced plans)");
 var DEFERRED_SWEEP_HARD_TIMEOUT_MS = 12e4;
-gcCmd.command("sweep-deferred").description("retry IDE-locked deferred worktree removals with backoff (#1932) \u2014 SessionStart + pr land spawn this detached").option("--quiet", "silent when registry empty or all cleared").option("--json", "machine-readable output").action(async (o) => {
+gcCmd.command("sweep-deferred").description("retry IDE-locked deferred worktree removals with backoff (#1932) ? SessionStart + pr land spawn this detached").option("--quiet", "silent when registry empty or all cleared").option("--json", "machine-readable output").action(async (o) => {
   await runWithSweepWatchdog(async () => {
     try {
       const deferredStore = await createDeferredWorktreeStore();
@@ -30263,7 +31159,7 @@ gcCmd.command("sweep-deferred").description("retry IDE-locked deferred worktree
       const result = await sweepDeferredWorktreesWithRetry(
         deferredStore,
         // #2841: `-c core.fsmonitor=false` stops a git fsmonitor daemon from inheriting this detached
-        // worker's stdio pipe (the likely Windows hang — execFile then never sees EOF and never resolves).
+        // worker's stdio pipe (the likely Windows hang ? execFile then never sees EOF and never resolves).
         worktreeRemoveDeps(async (args) => (await execFileP2("git", ["-c", "core.fsmonitor=false", ...args], { timeout: GIT_TIMEOUT_MS })).stdout),
         { removalContext }
       );
@@ -30278,11 +31174,11 @@ gcCmd.command("sweep-deferred").description("retry IDE-locked deferred worktree
       fail(`worktree gc sweep-deferred: ${e.message}`);
     }
   }, DEFERRED_SWEEP_HARD_TIMEOUT_MS, () => {
-    console.error("worktree gc sweep-deferred: exceeded hard timeout \u2014 exiting so the detached worker cannot leak (#2841)");
+    console.error("worktree gc sweep-deferred: exceeded hard timeout ? exiting so the detached worker cannot leak (#2841)");
     process.exit(process.exitCode ?? 0);
   });
 });
-gcCmd.option("--dry-run", "show what would be deleted (default)").option("--apply", "delete only the listed clean merged/closed PR local+remote branches, linked worktrees, and stale tracking refs").option("--json", "machine-readable output").option("--scratch", "prune safe local scratch (#1864) instead of git branches/refs; local plans are surfaced advisory-only, never auto-pruned").option("--remote <name>", "remote name", "origin").option("--limit <n>", "PRs to inspect per state", "200").option("--force", "remove worktrees even when the ownership registry shows another session created or worked in them recently (#3580)").option("--root <path>", "sweep an explicitly named worktrees root instead of the authoritative ../mmi-worktrees (#3471) \u2014 descends into this repo container when present; ownership, dead-dir, and content guards still apply").action(async (o) => {
+gcCmd.option("--dry-run", "show what would be deleted (default)").option("--apply", "delete only the listed clean merged/closed PR local+remote branches, linked worktrees, and stale tracking refs").option("--json", "machine-readable output").option("--scratch", "prune safe local scratch (#1864) instead of git branches/refs; local plans are surfaced advisory-only, never auto-pruned").option("--remote <name>", "remote name", "origin").option("--limit <n>", "PRs to inspect per state", "200").option("--force", "remove worktrees even when the ownership registry shows another session created or worked in them recently (#3580)").option("--root <path>", "sweep an explicitly named worktrees root instead of the authoritative ../mmi-worktrees (#3471) ? descends into this repo container when present; ownership, dead-dir, and content guards still apply").action(async (o) => {
   if (o.apply && o.dryRun) return fail("worktree gc: choose either --dry-run or --apply");
   if (o.scratch) {
     try {
@@ -30298,11 +31194,11 @@ gcCmd.option("--dry-run", "show what would be deleted (default)").option("--appl
   if (!Number.isFinite(limit) || limit < 1) return fail("worktree gc: --limit must be a positive integer");
   let root;
   if (o.root !== void 0) {
-    root = (0, import_node_path35.resolve)(o.root);
-    if (!(0, import_node_fs36.existsSync)(root) || !(0, import_node_fs36.statSync)(root).isDirectory()) return fail(`worktree gc: --root ${o.root} is not a directory`);
+    root = (0, import_node_path38.resolve)(o.root);
+    if (!(0, import_node_fs39.existsSync)(root) || !(0, import_node_fs39.statSync)(root).isDirectory()) return fail(`worktree gc: --root ${o.root} is not a directory`);
     const gcRepoRoot = (await execFileP2("git", ["rev-parse", "--show-toplevel"], { timeout: GIT_TIMEOUT_MS }).catch(() => ({ stdout: "" }))).stdout.trim() || process.cwd();
     if (isPathUnderDirectory(gcRepoRoot, root)) {
-      return fail(`worktree gc: --root ${root} contains this checkout \u2014 name a worktrees root, not the repo or an ancestor of it`);
+      return fail(`worktree gc: --root ${root} contains this checkout ? name a worktrees root, not the repo or an ancestor of it`);
     }
   }
   try {
@@ -30316,7 +31212,7 @@ gcCmd.option("--dry-run", "show what would be deleted (default)").option("--appl
       const removalContext = await currentWorktreeRemovalContext("worktree gc", o.force);
       await sweepDeferredWorktrees(
         deferredStore,
-        // #2841: same `-c core.fsmonitor=false` guard as the detached `gc sweep-deferred` worker — keep a
+        // #2841: same `-c core.fsmonitor=false` guard as the detached `gc sweep-deferred` worker ? keep a
         // git fsmonitor daemon from inheriting this sweep's stdio pipe and wedging the git call on Windows.
         worktreeRemoveDeps(async (args) => (await execFileP2("git", ["-c", "core.fsmonitor=false", ...args], { timeout: GIT_TIMEOUT_MS })).stdout),
         removalContext
@@ -30341,11 +31237,11 @@ var WORKTREE_SETUP_LOCK_TTL_MS = 10 * 6e4;
 function runWorktreeInstall(command, cwd, quiet, opts) {
   const stdio = quiet ? "ignore" : "inherit";
   return new Promise((resolve5, reject) => {
-    const child2 = opts?.shell ? (0, import_node_child_process16.spawn)(command, { cwd, stdio, windowsHide: true, shell: true }) : (() => {
+    const child2 = opts?.shell ? (0, import_node_child_process18.spawn)(command, { cwd, stdio, windowsHide: true, shell: true }) : (() => {
       const [bin, ...args] = command.split(" ");
       const file = isWin2 ? "cmd.exe" : bin;
       const spawnArgs = isWin2 ? ["/c", bin, ...args] : args;
-      return (0, import_node_child_process16.spawn)(file, spawnArgs, { cwd, stdio, windowsHide: true });
+      return (0, import_node_child_process18.spawn)(file, spawnArgs, { cwd, stdio, windowsHide: true });
     })();
     const timer = setTimeout(() => {
       try {
@@ -30378,14 +31274,14 @@ async function currentWorktreeRemovalContext(command, force) {
   };
 }
 async function unprovenWorktreeReason(wtPath, repoRoot2) {
-  if (!(0, import_node_fs36.existsSync)(wtPath)) return `${wtPath} does not exist on disk`;
+  if (!(0, import_node_fs39.existsSync)(wtPath)) return `${wtPath} does not exist on disk`;
   const porcelain = (await execFileP2("git", ["-C", repoRoot2, "worktree", "list", "--porcelain"], { timeout: GIT_TIMEOUT_MS }).catch(() => ({ stdout: "" }))).stdout;
   const registered = parseWorktreePorcelainEntries(porcelain);
   if (!registered.length) {
     return `'git worktree list' could not be read from ${repoRoot2}, so ${wtPath} could not be proven registered`;
   }
   if (!registered.some((w) => samePath(w.path, wtPath))) {
-    return `${wtPath} exists on disk but 'git worktree list' does not name it \u2014 its git metadata is gone, so it is not a usable worktree`;
+    return `${wtPath} exists on disk but 'git worktree list' does not name it ? its git metadata is gone, so it is not a usable worktree`;
   }
   return void 0;
 }
@@ -30400,26 +31296,26 @@ function makeProvisionDeps(worktreeRoot, quiet, log) {
 function acquireWorktreeSetupLock(worktreeRoot) {
   const lockPath = repoRuntimeStatePath(worktreeRoot, "worktree-setup.lock");
   const take = () => {
-    const fd = (0, import_node_fs36.openSync)(lockPath, "wx");
+    const fd = (0, import_node_fs39.openSync)(lockPath, "wx");
     try {
-      (0, import_node_fs36.writeSync)(fd, String(Date.now()));
+      (0, import_node_fs39.writeSync)(fd, String(Date.now()));
     } finally {
-      (0, import_node_fs36.closeSync)(fd);
+      (0, import_node_fs39.closeSync)(fd);
     }
     return () => {
       try {
-        (0, import_node_fs36.rmSync)(lockPath, { force: true });
+        (0, import_node_fs39.rmSync)(lockPath, { force: true });
       } catch {
       }
     };
   };
   try {
-    (0, import_node_fs36.mkdirSync)((0, import_node_path35.dirname)(lockPath), { recursive: true });
+    (0, import_node_fs39.mkdirSync)((0, import_node_path38.dirname)(lockPath), { recursive: true });
     return take();
   } catch {
     try {
-      if (Date.now() - (0, import_node_fs36.statSync)(lockPath).mtimeMs > WORKTREE_SETUP_LOCK_TTL_MS) {
-        (0, import_node_fs36.rmSync)(lockPath, { force: true });
+      if (Date.now() - (0, import_node_fs39.statSync)(lockPath).mtimeMs > WORKTREE_SETUP_LOCK_TTL_MS) {
+        (0, import_node_fs39.rmSync)(lockPath, { force: true });
         return take();
       }
     } catch {
@@ -30427,15 +31323,15 @@ function acquireWorktreeSetupLock(worktreeRoot) {
     return null;
   }
 }
-var worktree = program2.command("worktree").description("self-provisioning worktrees \u2014 install deps + copy local-only config");
+var worktree = program2.command("worktree").description("self-provisioning worktrees ? install deps + copy local-only config");
 withExamples(mutating(
-  worktree.command("create <branch-or-issue>").description("create a worktree from a base ref and provision it (install deps + copy local-only config); an issue ref derives the <issue>-<slug> branch, and --claim claims its board item (#2996, formerly worktree new)").option("--from <ref>", "base ref to branch from", "origin/development").option("--base <ref>", "alias of --from (git's own word for the base ref)").option("--path <path>", "worktree path (default: ../mmi-worktrees/<RepoName>/<branch> \u2014 authoritative; the <RepoName> segment is what makes ownership provable from the path, #3471. gc/list read this root in BOTH the nested and the legacy flat shape)").option("--remote <name>", "remote to fetch when --from is a <remote>/<branch> ref", "origin").option("--slug <slug>", "issue-ref form: override the slug derived from the issue title").option("--claim", "issue-ref form: claim the issue's board item after provisioning").option("--for <login>", "with --claim: assign the board item to this login instead of @me"),
+  worktree.command("create <branch-or-issue>").description("create a worktree from a base ref and provision it (install deps + copy local-only config); an issue ref derives the <issue>-<slug> branch, and --claim claims its board item (#2996, formerly worktree new)").option("--from <ref>", "base ref to branch from", "origin/development").option("--base <ref>", "alias of --from (git's own word for the base ref)").option("--path <path>", "worktree path (default: ../mmi-worktrees/<RepoName>/<branch> ? authoritative; the <RepoName> segment is what makes ownership provable from the path, #3471. gc/list read this root in BOTH the nested and the legacy flat shape)").option("--remote <name>", "remote to fetch when --from is a <remote>/<branch> ref", "origin").option("--slug <slug>", "issue-ref form: override the slug derived from the issue title").option("--claim", "issue-ref form: claim the issue's board item after provisioning").option("--for <login>", "with --claim: assign the board item to this login instead of @me"),
   worktreeCreatePlan
 ).action(async (target, o, cmd) => {
   let step = "resolve the branch name";
   try {
     if (o.base !== void 0 && cmd.getOptionValueSource("from") === "cli" && o.base !== o.from) {
-      return fail(`worktree create: --from and --base are the same option (--base is an alias); got --from ${o.from} and --base ${o.base} \u2014 pass one`);
+      return fail(`worktree create: --from and --base are the same option (--base is an alias); got --from ${o.from} and --base ${o.base} ? pass one`);
     }
     const fromRef = o.base ?? o.from;
     const issueForm = isIssueRef(target);
@@ -30448,7 +31344,7 @@ withExamples(mutating(
       const slug = o.slug ?? await fetchIssueTitle(selector.repo, selector.number).then((t) => t ? slugifyIssueTitle(t) : "");
       branch = buildNewBranchName(selector.number, slug ?? "");
       if (PROTECTED_BRANCHES2.has(branch)) {
-        return fail(`worktree create: generated branch name '${branch}' collides with a protected train branch \u2014 pass a branch name instead`);
+        return fail(`worktree create: generated branch name '${branch}' collides with a protected train branch ? pass a branch name instead`);
       }
     } else if (o.claim || o.for) {
       return fail("worktree create: --claim/--for need an issue-ref argument (e.g. worktree create 2687 --claim)");
@@ -30472,7 +31368,7 @@ withExamples(mutating(
     if (preferRemote && await revParseRef(preferRemote)) base = preferRemote;
     if (!o.json) {
       const baseSha = (await revParseRef(base))?.slice(0, 12) ?? "unresolved";
-      const localOnly = preferRemote && base !== preferRemote ? ` (no ${preferRemote} \u2014 local ref)` : "";
+      const localOnly = preferRemote && base !== preferRemote ? ` (no ${preferRemote} ? local ref)` : "";
       console.error(`  base ${base} ${baseSha}${localOnly}`);
     }
     const registered = parseWorktreePorcelainEntries((await execFileP2(
@@ -30488,7 +31384,7 @@ withExamples(mutating(
         return fail(`worktree create: ${wtPath} is already registered for '${exact.branch ?? "detached HEAD"}', not '${branch}'`);
       }
       const status = (await execFileP2("git", ["-C", wtPath, "status", "--porcelain"], { timeout: GIT_TIMEOUT_MS })).stdout.trim();
-      if (status) return fail(`worktree create: refusing to resume ${wtPath} \u2014 it has uncommitted changes`);
+      if (status) return fail(`worktree create: refusing to resume ${wtPath} ? it has uncommitted changes`);
       const head = await revParseRef(`refs/heads/${branch}`);
       const baseOid = await revParseRef(base);
       if (!head || !baseOid) return fail(`worktree create: could not prove '${branch}' and '${base}' before resume`);
@@ -30498,7 +31394,7 @@ withExamples(mutating(
         { timeout: GIT_TIMEOUT_MS }
       ).then(() => true).catch(() => false);
       if (!canFastForward) {
-        return fail(`worktree create: refusing to resume '${branch}' \u2014 it has local commits or diverges from ${base}`);
+        return fail(`worktree create: refusing to resume '${branch}' ? it has local commits or diverges from ${base}`);
       }
       await execFileP2("git", ["-C", wtPath, "merge", "--ff-only", base], { timeout: GIT_TIMEOUT_MS });
       resumed = true;
@@ -30571,11 +31467,11 @@ withExamples(mutating(
     console.log(`  installed: ${report.installed.map((i) => i.dir || ".").join(", ") || "none"}`);
     console.log(`  copied: ${report.copied.join(", ") || "none"}`);
     if (issueForm && o.claim && selector) {
-      if (claimError) console.error(`  warning: board claim failed (${claimError}) \u2014 worktree is ready, finish the claim manually`);
+      if (claimError) console.error(`  warning: board claim failed (${claimError}) ? worktree is ready, finish the claim manually`);
       else console.log(`  board item ${selector.repo}#${selector.number} claimed`);
     }
   } catch (e) {
-    fail(`worktree create: failed at step '${step}' \u2014 ${e.message}`);
+    fail(`worktree create: failed at step '${step}' ? ${e.message}`);
   }
 }), [
   "mmi-cli worktree create fix/gc-sweep-2687",
@@ -30586,7 +31482,7 @@ worktree.command("setup [path]").description("provision an existing worktree (in
   const root = path2 ?? process.cwd();
   const release = acquireWorktreeSetupLock(root);
   if (!release) {
-    if (!o.quiet && !o.json) console.log("worktree setup: another provision is in progress \u2014 skipping");
+    if (!o.quiet && !o.json) console.log("worktree setup: another provision is in progress ? skipping");
     return;
   }
   try {
@@ -30606,7 +31502,7 @@ worktree.command("setup [path]").description("provision an existing worktree (in
     release();
   }
 });
-worktree.command("events").description("who created and who removed this repo's worktrees \u2014 the append-only attribution log (#3580)").option("--limit <n>", "most recent events to show", "50").option("--json", "machine-readable output").action(async (o) => {
+worktree.command("events").description("who created and who removed this repo's worktrees ? the append-only attribution log (#3580)").option("--limit <n>", "most recent events to show", "50").option("--json", "machine-readable output").action(async (o) => {
   const limit = Number.parseInt(o.limit, 10);
   if (!Number.isFinite(limit) || limit < 1) return fail("worktree events: --limit must be a positive integer");
   const primaryRoot = await primaryCheckoutRoot(process.cwd()) ?? process.cwd();
@@ -30624,11 +31520,11 @@ async function attachToProject(issueNumber, repo, priority) {
   try {
     cfg = await loadConfigForRepo(targetRepo2);
   } catch (e) {
-    console.error(`issue create: board attach skipped \u2014 ${e.message}`);
+    console.error(`issue create: board attach skipped ? ${e.message}`);
     return { onBoard: false };
   }
   if (!cfg.projectId) {
-    console.error(`issue create: board attach skipped \u2014 no Hub registry board META for ${targetRepo2 ?? "current repo"}; run \`mmi-cli org project get ${targetRepo2 ?? "<owner/repo>"}\` and backfill board coords`);
+    console.error(`issue create: board attach skipped ? no Hub registry board META for ${targetRepo2 ?? "current repo"}; run \`mmi-cli org project get ${targetRepo2 ?? "<owner/repo>"}\` and backfill board coords`);
     return { onBoard: false };
   }
   try {
@@ -30674,7 +31570,7 @@ function scheduleRelatedDiscovery(o) {
   try {
     const args = ["issue", "discover-related", "--number", String(o.number), "--title", o.title, "--body", o.body, "--fail-soft"];
     if (o.repo) args.push("--repo", o.repo);
-    spawnDetachedSelf(args, { spawn: import_node_child_process16.spawn, execPath: process.execPath, scriptPath: process.argv[1] }, { cwd: process.cwd() });
+    spawnDetachedSelf(args, { spawn: import_node_child_process18.spawn, execPath: process.execPath, scriptPath: process.argv[1] }, { cwd: process.cwd() });
   } catch {
   }
 }
@@ -30683,14 +31579,236 @@ registerEdgeCommands(program2);
 registerBoxCommands(program2);
 registerSchedulesCommands(program2);
 registerSchedulesLiftCommand(program2);
-var docs = program2.command("docs").description("generated docs surfaces \u2014 the routing index (org knowledge layer)");
-docs.command("index").description("regenerate docs/index.md from the docs/ tree (--write, the default) or fail on drift (--check) \u2014 the generated routing index, never hand-maintained").option("--check", "compare against the committed docs/index.md and exit 1 on drift; never write").option("--write", "regenerate docs/index.md when it has drifted (the default)").action(async (o) => {
+var repoIndex = program2.command("repo-index").description("Hub cloud + local pointer index ? paths/symbols only, never wiki prose (Hub#4133)");
+repoIndex.command("rebuild").description("walk the checkout (git ls-files + gitignore/secrets walls), rebuild the local pointer index, drop orphans").option("--json", "machine-readable projection summary").action(async (o) => {
+  try {
+    const root = await repoRoot();
+    const repo = inferRepoSlug(root);
+    const built = rebuildRepoIndex(root, repo);
+    const symbolCount = built.entries.reduce((n, e) => n + e.symbols.length, 0);
+    if (o.json) {
+      consoleIo.log(JSON.stringify({
+        ok: true,
+        repo: built.repo,
+        builtAt: built.builtAt,
+        fileCount: built.entries.length,
+        symbolCount,
+        store: repoIndexStatus(root).path
+      }, null, 2));
+      return;
+    }
+    console.log(`repo-index: rebuilt ${built.repo} ? ${built.entries.length} files, ${symbolCount} symbols`);
+  } catch (e) {
+    await failGraceful(e.message);
+  }
+});
+repoIndex.command("publish").description("publish this checkout's projection to Hub cloud (rebuilds locally first; estate indexer also runs on a schedule)").option("--embed", "request Titan file embeddings on the Hub (capped per publish)").option("--json", "machine-readable result").action(async (o) => {
+  try {
+    const root = await repoRoot();
+    const repo = inferRepoSlug(root);
+    const built = rebuildRepoIndex(root, repo);
+    const cfg = await loadConfig();
+    const res = await publishRepoIndexCloud(
+      { repo, builtAt: built.builtAt, entries: built.entries, embed: o.embed === true },
+      registryClientDeps(cfg)
+    );
+    if (!res.ok) return await failGraceful(res.error);
+    if (o.json) {
+      consoleIo.log(JSON.stringify(res.body, null, 2));
+      return;
+    }
+    console.log(`repo-index: published ${res.body.repo} ? ${res.body.fileCount} files, emb=${res.body.embCount ?? 0}`);
+  } catch (e) {
+    return await failGraceful(e.message);
+  }
+});
+repoIndex.command("search").description("search Hub cloud by default (lexical/hybrid/semantic); use --local for checkout-only").argument("<query>", "path fragment, symbol, or meaning phrase").option("--limit <n>", "max hits", "20").option("--json", "machine-readable hits").option("--local", "search only the local projection (rebuild if missing)").option("--cloud", "force Hub cloud search (default when not --local)").option("--semantic", "semantic mode (Titan cosine over path+symbols embeddings)").option("--lexical", "lexical-only mode (paths/symbols)").option("--repo <owner/name>", "limit cloud search to one repo").action(async (query, o) => {
+  try {
+    const limit = Math.max(1, Math.min(100, Number(o.limit ?? 20) || 20));
+    const useLocal = o.local === true && o.cloud !== true;
+    if (useLocal) {
+      const root = await repoRoot();
+      let idx = loadRepoIndex(root);
+      if (!idx) idx = rebuildRepoIndex(root, inferRepoSlug(root));
+      const hits = searchRepoIndex(idx, query, limit);
+      if (o.json) {
+        consoleIo.log(JSON.stringify({ ok: true, source: "local", repo: idx.repo, query, hits }, null, 2));
+        return;
+      }
+      if (hits.length === 0) {
+        console.log(`repo-index: no local hits for ${JSON.stringify(query)}`);
+        return;
+      }
+      for (const h of hits) {
+        const sym = h.symbol ? `  ${h.symbol}` : "";
+        console.log(`${h.score.toFixed(2)}  ${h.kind.padEnd(8)}  ${h.path}${sym}  (${h.why})`);
+      }
+      return;
+    }
+    const mode = o.semantic ? "semantic" : o.lexical ? "lexical" : "hybrid";
+    const cfg = await loadConfig();
+    const res = await searchRepoIndexCloud(query, { mode, limit, repo: o.repo }, registryClientDeps(cfg));
+    if (!res.ok) return await failGraceful(res.error);
+    if (o.json) {
+      consoleIo.log(JSON.stringify({ source: "cloud", ...res }, null, 2));
+      return;
+    }
+    if (res.hits.length === 0) {
+      console.log(`repo-index: no cloud hits for ${JSON.stringify(query)} (${res.mode})`);
+      return;
+    }
+    for (const h of res.hits) {
+      const sym = h.symbol ? `  ${h.symbol}` : "";
+      console.log(`${h.score.toFixed(2)}  ${h.kind.padEnd(8)}  ${h.repo}  ${h.path}${sym}  (${h.why})`);
+    }
+  } catch (e) {
+    return await failGraceful(e.message);
+  }
+});
+repoIndex.command("status").description("show local and/or cloud repo-index status").option("--json", "machine-readable status").option("--cloud", "query Hub cloud status (estate or --repo)").option("--repo <owner/name>", "cloud status for one repo").action(async (o) => {
+  try {
+    if (o.cloud || o.repo) {
+      const cfg = await loadConfig();
+      const st2 = await statusRepoIndexCloud(o.repo, registryClientDeps(cfg));
+      if (isRepoIndexStatusError(st2)) {
+        if (o.json) {
+          consoleIo.log(JSON.stringify(st2, null, 2));
+          return await failGraceful(st2.error);
+        }
+        return await failGraceful(explainRepoIndexStatusError(st2));
+      }
+      if (o.json) {
+        consoleIo.log(JSON.stringify(st2, null, 2));
+        return;
+      }
+      if (st2.present === true && typeof st2.repo === "string") {
+        const fileCount = Number(st2.fileCount ?? 0);
+        const embCount = Number(st2.embCount ?? 0);
+        const embGap = Number(st2.embGap ?? Math.max(0, fileCount - embCount));
+        const stale = st2.staleBuiltAt === true ? " stale-builtAt" : "";
+        console.log(
+          `repo-index: cloud ${st2.repo} built ${st2.builtAt} ? ${fileCount} files, emb=${embCount}/${fileCount} gap=${embGap}${stale}`
+        );
+        return;
+      }
+      consoleIo.log(JSON.stringify(st2, null, 2));
+      const count = typeof st2.count === "number" ? st2.count : void 0;
+      const present = st2.present;
+      if (count === 0 || present === false) {
+        console.error(
+          "repo-index: no cloud projection yet ? after Hub deploy, run harbour `repo-index-reconcile` or `mmi-cli repo-index sync-estate` (see docs/Guides/repo-index-runbook.md)."
+        );
+      }
+      return;
+    }
+    const root = await repoRoot();
+    const st = repoIndexStatus(root);
+    if (o.json) {
+      consoleIo.log(JSON.stringify(st, null, 2));
+      return;
+    }
+    if (!st.present) {
+      console.log(`repo-index: local missing ? cloud search needs no rebuild; optional \`repo-index rebuild\` for --local`);
+      return;
+    }
+    console.log(`repo-index: local ${st.repo} built ${st.builtAt} ? ${st.fileCount} files, ${st.symbolCount} symbols`);
+  } catch (e) {
+    return await failGraceful(e.message);
+  }
+});
+repoIndex.command("health").description("post-deploy health gate: status + golden lexical/semantic queries (Hub#4149)").option("--live", "hit Hub cloud (status + searches); omit for offline golden-shape check").option("--golden <path>", "golden queries JSON (default: cli/testdata/repo-index-golden-queries.json)").option("--json", "machine-readable findings").action(async (o) => {
+  try {
+    const root = await repoRoot();
+    const goldenPath = o.golden || defaultGoldenPath(root);
+    const golden = loadGoldenSuite(goldenPath);
+    const result = o.live ? await runRepoIndexHealth({
+      golden,
+      live: {
+        status: async () => {
+          const cfg = await loadConfig();
+          const st = await statusRepoIndexCloud(void 0, registryClientDeps(cfg));
+          if ("error" in st && st.ok === false) return { ok: false, error: st.error };
+          return st;
+        },
+        search: async (q, mode) => {
+          const cfg = await loadConfig();
+          const res = await searchRepoIndexCloud(q, { mode, limit: 10 }, registryClientDeps(cfg));
+          if (!res.ok) {
+            return {
+              ok: false,
+              error: res.error,
+              status: res.status
+            };
+          }
+          return { ok: true, hits: res.hits };
+        }
+      }
+    }) : await runRepoIndexHealth({ golden });
+    if (o.json) {
+      consoleIo.log(JSON.stringify({ ok: result.ok, findings: result.findings, golden: goldenPath }, null, 2));
+    } else {
+      for (const f of result.findings) {
+        console.log(`${f.ok ? "ok" : "FAIL"}  ${f.code}  ${f.detail}`);
+      }
+      console.log(result.ok ? "repo-index health: PASS" : "repo-index health: FAIL");
+    }
+    if (!result.ok) process.exitCode = 1;
+  } catch (e) {
+    return await failGraceful(e.message);
+  }
+});
+repoIndex.command("gc").description("remove cloud projections for repos no longer on the registry roster").option("--cloud", "required ? GC only applies to Hub cloud").option("--json", "machine-readable result").action(async (o) => {
+  try {
+    if (!o.cloud) return await failGraceful("repo-index gc requires --cloud");
+    const cfg = await loadConfig();
+    const res = await gcRepoIndexCloud(registryClientDeps(cfg));
+    if (!res.ok) return await failGraceful(res.error);
+    if (o.json) {
+      consoleIo.log(JSON.stringify(res, null, 2));
+      return;
+    }
+    console.log(`repo-index: gc removed ${res.removed.length} orphan projection(s)`);
+  } catch (e) {
+    return await failGraceful(e.message);
+  }
+});
+repoIndex.command("sync-estate").description("Hub indexer: shallow-clone registry repos, rebuild, publish to cloud (CI / operator)").option("--repo <owner/name>", "limit to one registered repo").option("--embed", "request Titan embeddings on publish").option("--json", "machine-readable result").action(async (o) => {
+  try {
+    const cfg = await loadConfig();
+    const gh = process.env.GH_TOKEN || process.env.GITHUB_TOKEN || "";
+    if (!gh) await failGraceful("sync-estate needs GH_TOKEN or GITHUB_TOKEN with contents:read on target repos");
+    const res = await syncEstateRepoIndex({
+      deps: registryClientDeps(cfg),
+      repo: o.repo,
+      embed: o.embed === true,
+      githubToken: gh
+    });
+    if (o.json) {
+      consoleIo.log(JSON.stringify(res, null, 2));
+      if (!res.ok) process.exitCode = 1;
+      return;
+    }
+    for (const p of res.published) {
+      const gap = p.embGap ?? Math.max(0, p.fileCount - (p.embCount ?? 0));
+      const trunc = p.embTruncated ? " truncated" : "";
+      console.log(`repo-index: published ${p.repo} ? ${p.fileCount} files emb=${p.embCount ?? 0}/${p.fileCount} gap=${gap}${trunc}`);
+    }
+    for (const f of res.failed) {
+      console.error(`repo-index: FAILED ${f.repo}: ${f.error}`);
+    }
+    if (!res.ok) await failGraceful(`sync-estate incomplete (${res.failed.length} failed)`);
+  } catch (e) {
+    await failGraceful(e.message);
+  }
+});
+var docs = program2.command("docs").description("generated docs surfaces ? the routing index (org knowledge layer)");
+docs.command("index").description("regenerate docs/index.md from the docs/ tree (--write, the default) or fail on drift (--check) ? the generated routing index, never hand-maintained").option("--check", "compare against the committed docs/index.md and exit 1 on drift; never write").option("--write", "regenerate docs/index.md when it has drifted (the default)").action(async (o) => {
   try {
     const root = await repoRoot();
     const result = docsIndex(createDocsIndexDeps(root), { check: Boolean(o.check) });
     if (o.check) {
       if (result.drift) {
-        return failGraceful(`docs index: ${DOCS_INDEX_PATH} is stale \u2014 run \`mmi-cli docs index --write\` and commit the result`);
+        return failGraceful(`docs index: ${DOCS_INDEX_PATH} is stale ? run \`mmi-cli docs index --write\` and commit the result`);
       }
       console.log(`docs index: ${DOCS_INDEX_PATH} is current`);
       return;
@@ -30700,7 +31818,7 @@ docs.command("index").description("regenerate docs/index.md from the docs/ tree
     await failGraceful(e.message);
   }
 });
-docs.command("refs").description("deterministic doc reference gate: every backticked repo path, relative .md link, `mmi-cli` command ref, and `<!-- pinned by \u2026 -->` comment across docs/** + README.md + architecture.md must resolve, or exit 1 (fleet-portable port of the Hub gate scripts/check-doc-refs.mjs, #3339)").option("--json", "machine-readable findings list: { ok, docCount, findings[], warnings[] }").action(async (o) => {
+docs.command("refs").description("deterministic doc reference gate: every backticked repo path, relative .md link, `mmi-cli` command ref, and `<!-- pinned by ? -->` comment across docs/** + README.md + architecture.md must resolve, or exit 1 (fleet-portable port of the Hub gate scripts/check-doc-refs.mjs, #3339)").option("--json", "machine-readable findings list: { ok, docCount, findings[], warnings[] }").action(async (o) => {
   try {
     const root = await repoRoot();
     const commandPaths = new Set(buildCommandManifest(program2).index.map((entry) => entry.path));
@@ -30724,7 +31842,7 @@ docs.command("refs").description("deterministic doc reference gate: every backti
     await failGraceful(e.message);
   }
 });
-var spawnCmd = program2.command("spawn").description("this repo's process-spawn contract \u2014 every child process must be unable to pop a console window");
+var spawnCmd = program2.command("spawn").description("this repo's process-spawn contract ? every child process must be unable to pop a console window");
 spawnCmd.command("policy").description("enforce the windowsHide contract across this repo's tracked source: a child_process call must set windowsHide, or take its options from a named constant, a type annotation, or a forwarded caller bag that does. Waive a call the scan cannot classify with a `// windows-hide-exempt: <reason>` comment on the line above it (#3979)").option("--json", "machine-readable result: { ok, scannedCount, findings[] }").action(async (o) => {
   try {
     const root = await repoRoot();
@@ -30740,14 +31858,14 @@ spawnCmd.command("policy").description("enforce the windowsHide contract across
     }
     for (const f of result.findings) console.error(`spawn policy: ${f.detail}`);
     console.error(
-      "\nA process spawned without windowsHide allocates a console when it has none to inherit.\nWhere Windows Terminal is the default terminal, that console becomes a desktop window the\nhost never reaps \u2014 it outlives the process as an empty frame. Set windowsHide: true, or\nroute the call through a helper that does."
+      "\nA process spawned without windowsHide allocates a console when it has none to inherit.\nWhere Windows Terminal is the default terminal, that console becomes a desktop window the\nhost never reaps ? it outlives the process as an empty frame. Set windowsHide: true, or\nroute the call through a helper that does."
     );
     process.exitCode = 1;
   } catch (e) {
     await failGraceful(e.message);
   }
 });
-var tests = program2.command("tests").description("a repo's test-policy.json \u2014 the opt-in test contract and its enforcement");
+var tests = program2.command("tests").description("a repo's test-policy.json ? the opt-in test contract and its enforcement");
 tests.command("policy").description("enforce this repo's test-policy.json against the diff: a mandatory-zone change must carry a test, an unrequested new test file is refused, a `protected` test file may not be deleted or renamed away, and a `protected` entry naming a missing file is refused. Override any of them with a `Test-Policy-Override: <reason>` commit trailer (#3605)").option("--json", "machine-readable result: { ok, base, changedCount, findings[] }").option("--base <ref>", "comparison base (default: TEST_POLICY_BASE, then origin/development, then origin/main)").action(async (o) => {
   try {
     const root = await repoRoot();
@@ -30760,7 +31878,7 @@ tests.command("policy").description("enforce this repo's test-policy.json agains
     if (result.overriddenBy && result.ok) {
       const { sha, reason, kinds } = result.overriddenBy;
       const scope = (result.waived ?? []).map((f) => f.kind).join(", ") || "nothing";
-      console.log(`tests policy: overridden by ${sha.slice(0, 8)} (waiving ${scope}; scope ${kinds.join(", ")}) \u2014 ${reason}`);
+      console.log(`tests policy: overridden by ${sha.slice(0, 8)} (waiving ${scope}; scope ${kinds.join(", ")}) ? ${reason}`);
       return;
     }
     if (result.ok) {
@@ -30775,7 +31893,7 @@ tests.command("policy").description("enforce this repo's test-policy.json agains
     await failGraceful(e.message);
   }
 });
-var docsAudit = program2.command("docs-audit").description("the docs janitor verdict ledger \u2014 record a dated run verdict, or read the dead-man status back");
+var docsAudit = program2.command("docs-audit").description("the docs janitor verdict ledger ? record a dated run verdict, or read the dead-man status back");
 docsAudit.command("record").description("write a dated janitor verdict for one repo to the registry ledger (master-only server-side)").option("--repo <owner/name>", "the repo the verdict is for (default: the current repo)").option("--date <YYYY-MM-DD>", "the ISO day the run examined (default: today)").requiredOption("--sha-range <a..b>", "the git range the janitor read (e.g. <lastVerdictSha>..HEAD)").addOption(new Option("--outcome <kind>", "clean | refreshed | failed").makeOptionMandatory().choices(["clean", "refreshed", "failed"])).option("--count <n>", "docs refreshed (required when --outcome refreshed)").option("--reason <text>", "why the run failed (required when --outcome failed)").requiredOption("--checker-vendor <vendor>", "which vendor's model actually ran the check").action(async (o) => {
   try {
     const repo = o.repo ?? await currentRepoFullName();
@@ -30791,7 +31909,7 @@ docsAudit.command("record").description("write a dated janitor verdict for one r
     await failGraceful(e.message);
   }
 });
-docsAudit.command("status").description("read the janitor dead-man verdict back for one repo \u2014 missing/stale/failed is RED; a not-yet-armed registry route is an informational exit 0").option("--repo <owner/name>", "the repo to check (default: the current repo)").option("--json", "machine-readable output \u2014 the discrete state rather than the sentence").action(async (o) => {
+docsAudit.command("status").description("read the janitor dead-man verdict back for one repo ? missing/stale/failed is RED; a not-yet-armed registry route is an informational exit 0").option("--repo <owner/name>", "the repo to check (default: the current repo)").option("--json", "machine-readable output ? the discrete state rather than the sentence").action(async (o) => {
   try {
     const repo = o.repo ?? await currentRepoFullName();
     const today = (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
@@ -30824,7 +31942,7 @@ async function reportWrite(label, res) {
   }
   if (res.error) return failGraceful(`${label}: ${res.error}`);
   const detail = res.body?.error ?? "";
-  return failGraceful(`${label}: HTTP ${res.status}${detail ? ` \u2014 ${detail}` : ""}`);
+  return failGraceful(`${label}: HTTP ${res.status}${detail ? ` ? ${detail}` : ""}`);
 }
 var tenant = program2.command("tenant").description("tenant runtime control through Hub authority");
 tenant.command("control <owner/repo> <stage> <action>").description("bounded tenant control plus value-free vault/broker verification; project-admin own dev/rc, master main").option("--watch", "block on the dispatched run and report its conclusion (status/retire/verify-secrets/verify-broker/logs watch by default)").option("--lines <n>", "logs only: trailing lines of the tenant service to return (1-2000, default 200)").option("--json", "machine-readable output").action(async (repo, stage, action, o) => {
@@ -30851,7 +31969,7 @@ tenant.command("control <owner/repo> <stage> <action>").description("bounded ten
       printLine(o.json ? JSON.stringify(result, null, 2) : renderTenantControl(result));
     }
     if (result.conclusion === "failure") {
-      return failGraceful(`runtime tenant control ${stage} ${action}: ${result.category ?? "failed"} \u2014 ${result.note}`);
+      return failGraceful(`runtime tenant control ${stage} ${action}: ${result.category ?? "failed"} ? ${result.note}`);
     }
   } catch (e) {
     return failGraceful(`runtime tenant control: ${e.message}`);
@@ -30860,7 +31978,7 @@ tenant.command("control <owner/repo> <stage> <action>").description("bounded ten
 tenant.command("reconcile <owner/repo> <stage>").description("re-render this tenant stage's generated box assets from registry truth; project-admin own dev/rc, master main; watches by default").option("--watch", "wait for the tenant-reconcile.yml run (default)").option("--no-watch", "return after dispatch; do not redeploy until the reconcile run succeeds").option("--json", "machine-readable output").action(async (repo, stage, o) => {
   try {
     const result = await runTenantReconcile(trainApplyDeps(), { repo, stage, watch: o.watch });
-    printLine(o.json ? JSON.stringify(result, null, 2) : `${result.note}${result.runUrl ? ` \u2014 ${result.runUrl}` : ""}`);
+    printLine(o.json ? JSON.stringify(result, null, 2) : `${result.note}${result.runUrl ? ` ? ${result.runUrl}` : ""}`);
     if (result.conclusion === "failure" || !result.dispatched) process.exitCode = 1;
   } catch (e) {
     return failGraceful(`runtime tenant reconcile: ${e.message}`);
@@ -30873,7 +31991,7 @@ tenant.command("status <owner/repo> <stage>").description("read tenant runtime r
   console.log(JSON.stringify(result, null, 2));
   if (result.publicProbe?.ok === false) process.exitCode = 1;
 });
-tenant.command("redeploy <owner/repo> <stage>").description("re-dispatch the central tenant-deploy.yml for an already-promoted ref (no re-tag/merge); train-authority gated").option("--ref <ref>", "ref to deploy (defaults to the stage branch rc/main, or `development` for dev \u2014 the promoted/staging ref)").option("--watch", "block on the dispatched run and report its outcome (gh run watch --exit-status)").option("--json", "machine-readable output").action(async (repo, stage, o) => {
+tenant.command("redeploy <owner/repo> <stage>").description("re-dispatch the central tenant-deploy.yml for an already-promoted ref (no re-tag/merge); train-authority gated").option("--ref <ref>", "ref to deploy (defaults to the stage branch rc/main, or `development` for dev ? the promoted/staging ref)").option("--watch", "block on the dispatched run and report its outcome (gh run watch --exit-status)").option("--json", "machine-readable output").action(async (repo, stage, o) => {
   if (stage !== "dev" && stage !== "rc" && stage !== "main") return fail("runtime tenant redeploy: <stage> must be dev, rc, or main");
   try {
     const result = await runTenantRedeploy(trainApplyDeps(), { repo, stage, ref: o.ref, watch: o.watch });
@@ -30882,9 +32000,9 @@ tenant.command("redeploy <owner/repo> <stage>").description("re-dispatch the cen
     return failGraceful(`runtime tenant redeploy: ${e.message}`);
   }
 });
-tenant.command("sweep-rc").description("discover (and optionally retire) running rc tenant runtimes across tenant-containers \u2014 orphan cleanup after a failed post-release retire (#942)").option("--retire", "retire every running rc runtime found (requires --yes) \u2014 WARNING: tears down a legitimately-staged rc too").option("--yes", "confirm the destructive --retire").option("--json", "machine-readable output").action(async (o) => {
+tenant.command("sweep-rc").description("discover (and optionally retire) running rc tenant runtimes across tenant-containers ? orphan cleanup after a failed post-release retire (#942)").option("--retire", "retire every running rc runtime found (requires --yes) ? WARNING: tears down a legitimately-staged rc too").option("--yes", "confirm the destructive --retire").option("--json", "machine-readable output").action(async (o) => {
   if (o.retire && !o.yes) {
-    return fail("runtime tenant sweep-rc --retire is destructive (it tears down EVERY running rc, including one legitimately staged between /rcand and /release) \u2014 re-run with --yes to confirm");
+    return fail("runtime tenant sweep-rc --retire is destructive (it tears down EVERY running rc, including one legitimately staged between /rcand and /release) ? re-run with --yes to confirm");
   }
   const cfg = await loadConfig();
   const cdeps = registryClientDeps(cfg);
@@ -30937,7 +32055,7 @@ async function buildTenantRuntimeStatusFor(target, stage, cfg) {
     lastTenantDeployRun: (await fetchLastTenantDeployRun(slug, stage)).run
   });
 }
-var project = program2.command("project").description("the DDB org registry \u2014 list/get projects (any member); set is master-only");
+var project = program2.command("project").description("the DDB org registry ? list/get projects (any member); set is master-only");
 async function projectTarget(commandName, explicitTarget) {
   return requireProjectTarget(commandName, explicitTarget, explicitTarget ? void 0 : await resolveRepo());
 }
@@ -30981,7 +32099,7 @@ project.command("list").description("list all projects (identity + board, never
     console.log(`${p.slug ?? "?"} - ${p.name ?? ""}${p.division ? ` [${p.division}]` : ""}${p.class ? ` (${p.class})` : ""}${p.projectType ? ` <${p.projectType}>` : ""}${p.deployModel ? ` {${p.deployModel}}` : ""}`);
   }
 });
-project.command("get [owner/repo]").description("a project's META (board ids + pointers) by repo or slug; defaults to the current repo \u2014 identity, NOT deploy coords").option("--json", "machine-readable output").action(async (repoOrSlug, o) => {
+project.command("get [owner/repo]").description("a project's META (board ids + pointers) by repo or slug; defaults to the current repo ? identity, NOT deploy coords").option("--json", "machine-readable output").action(async (repoOrSlug, o) => {
   const cfg = await loadConfig();
   let target;
   try {
@@ -30991,7 +32109,7 @@ project.command("get [owner/repo]").description("a project's META (board ids + p
   }
   const read = await fetchProjectBySlugChecked(slugOf(target), registryClientDeps(cfg));
   if (!read.ok) {
-    return failGraceful(`org project get: Hub registry read failed (${read.error}) \u2014 likely transient (cold start, network, or auth blip); retry shortly`);
+    return failGraceful(`org project get: Hub registry read failed (${read.error}) ? likely transient (cold start, network, or auth blip); retry shortly`);
   }
   if (!read.project) {
     return failGraceful(`org project get: no registry META for ${target} (unknown or unbootstrapped)`);
@@ -31001,10 +32119,10 @@ project.command("get [owner/repo]").description("a project's META (board ids + p
     const m = read.project;
     const track = resolveReleaseTrack(m, void 0, target);
     const stages = branchesForTrack(track).join(" -> ");
-    const note = track === "direct" ? " (direct \u2014 no rc; /rcand refuses, /release ships development -> main)" : track === "trunk" ? " (trunk \u2014 main only)" : "";
+    const note = track === "direct" ? " (direct ? no rc; /rcand refuses, /release ships development -> main)" : track === "trunk" ? " (trunk ? main only)" : "";
     console.error(
-      `${m.name ?? target} \xB7 class ${m.class ?? "?"} \xB7 deploy ${m.deployModel ?? "?"}
-release track: ${track} \u2014 stages: ${stages}${note}
+      `${m.name ?? target} ? class ${m.class ?? "?"} ? deploy ${m.deployModel ?? "?"}
+release track: ${track} ? stages: ${stages}${note}
 deploys run centrally (tenant-deploy.yml); product repos carry no deploy files. Inspect nonsecret DEPLOY facts with \`mmi-cli org project deploy get\`; full coords remain OIDC-gated.`
     );
   }
@@ -31037,7 +32155,7 @@ projectDeploy.command("get [owner/repo]").description("read nonsecret DEPLOY# fa
   const payload = stage ? { slug: out.slug, stage, deploy: out.stages[stage] ?? null } : out;
   console.log(JSON.stringify(payload));
 });
-project.command("set [owner/repo]").description("upsert project META (idempotent merge; master-gated)").addOption(new Option("--class <class>", "deployable | content").choices(["deployable", "content"])).addOption(new Option("--project-type <type>", `${PROJECT_TYPES.join(" | ")} (capability shape)`).choices([...PROJECT_TYPES])).addOption(new Option("--deploy-model <model>", `${DEPLOY_MODELS.join(" | ")} (release/deploy path; none means no Hub deploy registration)`).choices([...DEPLOY_MODELS])).addOption(new Option("--release-track <track>", `${RELEASE_TRACKS.join(" | ")} (branch topology; direct skips rc)`).choices([...RELEASE_TRACKS])).option("--var <KEY=VALUE...>", settableVarHelp()).option("--set <KEY=VALUE...>", "alias of --var (one KEY=VALUE per flag; repeat the flag to set several)").option("--secrets-file <path>", 'read the #2244 secrets catalog map (JSON) from a file and merge it per entry into the existing catalog (clear all with --unset secrets). SHAPE: a JSON object keyed by env name, each entry {"key":"UPPER_SNAKE" (repeat the env name), "purpose":"<non-empty>", "group":"<e.g. auth|database>", "owner":"<github login>", "stages":[] (empty = the one stageless shared value; else any of dev/rc/main), "consumers":["runtime"|"box"|\u2026], "provider":"<optional>"}').option("--unset <KEY...>", "META field to remove (repeatable): oauth, requiredRuntimeSecrets, requiredBuildSecrets, secrets, edgeDomains, requiredGcpApis, publishRequired").option("--clear-web-profile", "remove web-only registry fields (oauth, edgeDomains) for non-web/content projects").option("--json", "machine-readable output").action(async (repoOrSlug, o) => {
+project.command("set [owner/repo]").description("upsert project META (idempotent merge; master-gated)").addOption(new Option("--class <class>", "deployable | content").choices(["deployable", "content"])).addOption(new Option("--project-type <type>", `${PROJECT_TYPES.join(" | ")} (capability shape)`).choices([...PROJECT_TYPES])).addOption(new Option("--deploy-model <model>", `${DEPLOY_MODELS.join(" | ")} (release/deploy path; none means no Hub deploy registration)`).choices([...DEPLOY_MODELS])).addOption(new Option("--release-track <track>", `${RELEASE_TRACKS.join(" | ")} (branch topology; direct skips rc)`).choices([...RELEASE_TRACKS])).option("--var <KEY=VALUE...>", settableVarHelp()).option("--set <KEY=VALUE...>", "alias of --var (one KEY=VALUE per flag; repeat the flag to set several)").option("--secrets-file <path>", 'read the #2244 secrets catalog map (JSON) from a file and merge it per entry into the existing catalog (clear all with --unset secrets). SHAPE: a JSON object keyed by env name, each entry {"key":"UPPER_SNAKE" (repeat the env name), "purpose":"<non-empty>", "group":"<e.g. auth|database>", "owner":"<github login>", "stages":[] (empty = the one stageless shared value; else any of dev/rc/main), "consumers":["runtime"|"box"|?], "provider":"<optional>"}').option("--unset <KEY...>", "META field to remove (repeatable): oauth, requiredRuntimeSecrets, requiredBuildSecrets, secrets, edgeDomains, requiredGcpApis, publishRequired").option("--clear-web-profile", "remove web-only registry fields (oauth, edgeDomains) for non-web/content projects").option("--json", "machine-readable output").action(async (repoOrSlug, o) => {
   const cfg = await loadConfig();
   let target;
   try {
@@ -31053,7 +32171,7 @@ project.command("set [owner/repo]").description("upsert project META (idempotent
   if (dupe) return fail(`org project set: KEY "${dupe}" was passed to both --var and --set; --set is an alias of --var, so pass each KEY once`);
   if (o.secretsFile) {
     try {
-      vars.push(`secrets=${(0, import_node_fs36.readFileSync)(o.secretsFile, "utf8")}`);
+      vars.push(`secrets=${(0, import_node_fs39.readFileSync)(o.secretsFile, "utf8")}`);
     } catch (e) {
       return fail(`org project set: cannot read --secrets-file ${o.secretsFile}: ${e.message}`);
     }
@@ -31078,7 +32196,7 @@ project.command("set [owner/repo]").description("upsert project META (idempotent
   const res = await upsertProject(slug, { ...patch, repo }, registryClientDeps(cfg));
   return reportWrite("org project set", res);
 });
-project.command("retire [owner/repo]").description("retire an orphaned registry slug (master-only): soft-delete the PROJECT# META row + drop the repo's board items; secrets/vault left alone. DRY-RUN by default \u2014 pass --apply to actually delete; defaults to the current repo").option("--apply", "actually delete (default is a dry-run preview of what would be removed)").option("--skip-board", "retire the registry META only \u2014 leave board items in place").option("--json", "machine-readable {slug, removedMeta, removedBoardItem} output").action(async (repoOrSlug, o) => {
+project.command("retire [owner/repo]").description("retire an orphaned registry slug (master-only): soft-delete the PROJECT# META row + drop the repo's board items; secrets/vault left alone. DRY-RUN by default ? pass --apply to actually delete; defaults to the current repo").option("--apply", "actually delete (default is a dry-run preview of what would be removed)").option("--skip-board", "retire the registry META only ? leave board items in place").option("--json", "machine-readable {slug, removedMeta, removedBoardItem} output").action(async (repoOrSlug, o) => {
   const cfg = await loadConfig();
   let target;
   try {
@@ -31110,9 +32228,9 @@ project.command("retire [owner/repo]").description("retire an orphaned registry
     const verb = result.applied ? "retired" : "WOULD retire (dry-run; pass --apply to delete)";
     printLine(`org project retire: ${verb} ${result.slug} (${result.repo})`);
     if (result.applied) {
-      printLine(`  META: ${result.removedMeta.ok ? `removed=${result.removedMeta.removed ?? "unknown"}` : `FAILED \u2014 ${result.removedMeta.error}`}`);
+      printLine(`  META: ${result.removedMeta.ok ? `removed=${result.removedMeta.removed ?? "unknown"}` : `FAILED ? ${result.removedMeta.error}`}`);
     } else {
-      printLine(`  META: ${result.removedMeta.ok ? result.removedMeta.existing ? "live row present \u2014 would be tombstoned" : "no live row (already absent/tombstoned)" : `read failed \u2014 ${result.removedMeta.error}`}`);
+      printLine(`  META: ${result.removedMeta.ok ? result.removedMeta.existing ? "live row present ? would be tombstoned" : "no live row (already absent/tombstoned)" : `read failed ? ${result.removedMeta.error}`}`);
     }
     if (result.removedBoardItem) {
       const b = result.removedBoardItem;
@@ -31123,7 +32241,7 @@ project.command("retire [owner/repo]").description("retire an orphaned registry
     printLine(`  ${result.vaultNote}`);
   }
   if (result.applied && !result.removedMeta.ok) {
-    return failGraceful(`org project retire: META delete failed \u2014 ${result.removedMeta.error}`);
+    return failGraceful(`org project retire: META delete failed ? ${result.removedMeta.error}`);
   }
 });
 var fullTrack = program2.command("full-track").description("direct-to-train readiness audits");
@@ -31151,7 +32269,7 @@ fullTrack.command("readiness <owner/repo>").description("aggregate branch topolo
   console.log(JSON.stringify(report, null, 2));
   if (!report.rcand.canApply) process.exitCode = 1;
 });
-project.command("set-deploy [owner/repo]").description("patch a tenant DEPLOY row \u2014 project-admin may set only --no-env-file on their own existing dev/rc row; master may seed/change all coords and main; defaults to the current repo").addOption(new Option("--stage <stage>", "dev | rc | main").makeOptionMandatory().choices(["dev", "rc", "main"])).option("--ssh-host <host>", "the box address the deploy ssh-es into; omit to keep the stored value (required only for a NEW hetzner-ssh row \u2014 `mmi-cli runtime box list` finds it)").option("--ssh-user <user>", "ssh user; omit to leave the row unchanged (default root on a new row)").option("--port <port>", "loopback port the container binds / Caddy upstream (1..65535); omit to leave the row unchanged").addOption(new Option("--substrate <substrate>", "hetzner-ssh | s3-cloudfront; omit to leave the row unchanged").choices([...DEPLOY_SUBSTRATES])).option("--deploy-role-arn <arn>", "s3-cloudfront: the scoped OIDC deployer role tenant-deploy.yml assumes for this stage").option("--app-bucket <bucket>", "s3-cloudfront: the S3 bucket the built dist/ is synced into").option("--distribution-id <id>", "s3-cloudfront: the CloudFront distribution invalidated after the sync").option("--distribution-domain <domain>", "s3-cloudfront: the host the post-deploy security-header proof is measured against").option("--deploy-path <path>", "on-box per-stage release root; omit to leave the row unchanged (default /opt/mmi/<slug>/<stage> on a new row)").option("--service <name>", "systemd/compose service name; omit to leave the row unchanged (default the slug on a new row)").option("--domain <domain>", "canonical serving host; omit to leave the row unchanged").option("--alias <domain...>", "extra serving hostname the box Caddy answers (repeatable); omit to leave the stored aliases unchanged").option("--clear-aliases", "remove EVERY serving alias from the row (#2986) \u2014 omitting --alias preserves them, so clearing needs saying out loud").option("--no-env-file <bool>", "set the DEPLOY# fileless flag (true|false) \u2014 own-repo project-admin dev/rc; master main; true = env passthrough with no .env symlink").option("--force", "explicit recovery override: skip fileless-compose verification only after independent proof").option("--json", "machine-readable output").action(async (repoOrSlug, o) => {
+project.command("set-deploy [owner/repo]").description("patch a tenant DEPLOY row ? project-admin may set only --no-env-file on their own existing dev/rc row; master may seed/change all coords and main; defaults to the current repo").addOption(new Option("--stage <stage>", "dev | rc | main").makeOptionMandatory().choices(["dev", "rc", "main"])).option("--ssh-host <host>", "the box address the deploy ssh-es into; omit to keep the stored value (required only for a NEW hetzner-ssh row ? `mmi-cli runtime box list` finds it)").option("--ssh-user <user>", "ssh user; omit to leave the row unchanged (default root on a new row)").option("--port <port>", "loopback port the container binds / Caddy upstream (1..65535); omit to leave the row unchanged").addOption(new Option("--substrate <substrate>", "hetzner-ssh | s3-cloudfront; omit to leave the row unchanged").choices([...DEPLOY_SUBSTRATES])).option("--deploy-role-arn <arn>", "s3-cloudfront: the scoped OIDC deployer role tenant-deploy.yml assumes for this stage").option("--app-bucket <bucket>", "s3-cloudfront: the S3 bucket the built dist/ is synced into").option("--distribution-id <id>", "s3-cloudfront: the CloudFront distribution invalidated after the sync").option("--distribution-domain <domain>", "s3-cloudfront: the host the post-deploy security-header proof is measured against").option("--deploy-path <path>", "on-box per-stage release root; omit to leave the row unchanged (default /opt/mmi/<slug>/<stage> on a new row)").option("--service <name>", "systemd/compose service name; omit to leave the row unchanged (default the slug on a new row)").option("--domain <domain>", "canonical serving host; omit to leave the row unchanged").option("--alias <domain...>", "extra serving hostname the box Caddy answers (repeatable); omit to leave the stored aliases unchanged").option("--clear-aliases", "remove EVERY serving alias from the row (#2986) ? omitting --alias preserves them, so clearing needs saying out loud").option("--no-env-file <bool>", "set the DEPLOY# fileless flag (true|false) ? own-repo project-admin dev/rc; master main; true = env passthrough with no .env symlink").option("--force", "explicit recovery override: skip fileless-compose verification only after independent proof").option("--json", "machine-readable output").action(async (repoOrSlug, o) => {
   const cfg = await loadConfig();
   let target;
   try {
@@ -31177,7 +32295,7 @@ ${filelessTransitionGuide(target, o.stage)}`);
         if (verdict.warn) console.error(`org project set-deploy: ${verdict.warn}`);
       } else if (!o.force) {
         return fail(
-          `org project set-deploy: cannot verify ${target} ${branch} from this checkout \u2014 refusing to change noEnvFile. Run from the target repo with origin/${branch} fetched.
+          `org project set-deploy: cannot verify ${target} ${branch} from this checkout ? refusing to change noEnvFile. Run from the target repo with origin/${branch} fetched.
 ${filelessTransitionGuide(target, o.stage)}`
         );
       } else {
@@ -31212,14 +32330,14 @@ ${filelessTransitionGuide(target, o.stage)}`
   const res = await setDeployCoords(slug, body, registryClientDeps(cfg));
   return reportWrite("org project set-deploy", res);
 });
-var registry = program2.command("registry").description("the DDB org registry \u2014 org-level constants");
+var registry = program2.command("registry").description("the DDB org registry ? org-level constants");
 registry.command("org").description("the org config (account id, region, orgProjectId, sagaApiUrl)").option("--json", "machine-readable output").action(async (_o) => {
   const cfg = await loadConfig();
   const org = await fetchOrgConfig(registryClientDeps(cfg));
   if (!org) return failGraceful("org config get: Hub API unreachable, unseeded, or this repo is not bootstrapped");
   console.log(JSON.stringify(org));
 });
-var oauth = program2.command("oauth").description("per-repo Google OAuth \u2014 plan the canonical URI set, verify the client is port-agnostic");
+var oauth = program2.command("oauth").description("per-repo Google OAuth ? plan the canonical URI set, verify the client is port-agnostic");
 oauth.command("plan", { isDefault: true }).description("print the canonical JS origins + redirect URIs + SSM cred param names for this repo").option("--repo <owner/repo>", "slug source (defaults to the current repo)").option("--json", "machine-readable output").action(async (o) => {
   const cfg = await loadConfig();
   const slug = (o.repo ? o.repo.split("/").pop() : cfg.project ?? await repoSlug()).toLowerCase();
@@ -31233,7 +32351,7 @@ oauth.command("plan", { isDefault: true }).description("print the canonical JS o
       return failGraceful(
         `org oauth plan: ${message}. Declare it in the registry META first:
   mmi-cli org project set ${o.repo ?? `mutmutco/${slug}`} --var 'oauth={"subdomains":["${defaultSubdomain(slug)}"],"callbackPath":"${DEFAULT_CALLBACK_PATH}"}'
-  New repo? The GCP project and its Google Auth Platform consent screen must exist too \u2014 docs/Guides/oauth-provision.md \xA7 New repo.`
+  New repo? The GCP project and its Google Auth Platform consent screen must exist too ? docs/Guides/oauth-provision.md ? New repo.`
       );
     }
     return failGraceful(`org oauth plan: ${message}`);
@@ -31259,7 +32377,7 @@ SSM cred params (under /mmi-future/${slug}/):`);
 oauth.command("set-creds").description('store the OAuth client into the canonical stageless GOOGLE_CLIENT_ID/SECRET pair (pipe the Console "Download JSON" on stdin)').option("--repo <owner/repo>", "target repo (defaults to the current repo)").action(async (o) => {
   const raw = await readStdin();
   if (!raw.trim()) {
-    return fail("org oauth set-creds: pipe the Google client JSON on stdin \u2014 e.g.\n  mmi-cli org oauth set-creds --repo <owner/repo> < client.json");
+    return fail("org oauth set-creds: pipe the Google client JSON on stdin ? e.g.\n  mmi-cli org oauth set-creds --repo <owner/repo> < client.json");
   }
   let creds;
   try {
@@ -31309,9 +32427,9 @@ oauth.command("verify").description("probe Google authorize with an arbitrary po
   if (o.json) {
     console.log(JSON.stringify({ slug, redirectUri, portAgnostic: !mismatch }));
   } else if (mismatch) {
-    console.error(`FAIL ${slug}: redirect_uri_mismatch for ${redirectUri} \u2014 client is not port-agnostic (run /oauth-provision)`);
+    console.error(`FAIL ${slug}: redirect_uri_mismatch for ${redirectUri} ? client is not port-agnostic (run /oauth-provision)`);
   } else {
-    console.log(`PASS ${slug}: ${redirectUri} accepted \u2014 port-agnostic OAuth is live`);
+    console.log(`PASS ${slug}: ${redirectUri} accepted ? port-agnostic OAuth is live`);
   }
   if (mismatch) process.exitCode = 1;
 });
@@ -31324,7 +32442,7 @@ function resolveCreatePriority(raw, command) {
   try {
     return normalizePriority(raw);
   } catch {
-    fail(`${command}: unknown priority "${raw}" \u2014 expected one of: ${CLI_PRIORITIES.join(", ")}`, {
+    fail(`${command}: unknown priority "${raw}" ? expected one of: ${CLI_PRIORITIES.join(", ")}`, {
       code: ERROR_CODES.ERR_BAD_ENUM,
       offending_flag: "--priority",
       expected: [...CLI_PRIORITIES]
@@ -31334,15 +32452,15 @@ function resolveCreatePriority(raw, command) {
 function resolveCreateType(raw, command, labels) {
   if (raw === void 0 || raw === "") {
     const nearMiss = labels?.find((l) => ISSUE_TYPES.includes(l));
-    const hint = nearMiss ? ` (you passed --label ${nearMiss} \u2014 did you mean --type ${nearMiss}?)` : "";
+    const hint = nearMiss ? ` (you passed --label ${nearMiss} ? did you mean --type ${nearMiss}?)` : "";
     fail(`${command}: --type is required (bug | feature | task) unless --batch supplies it per row${hint}`, {
       code: ERROR_CODES.ERR_MISSING_FLAG,
       offending_flag: "--type",
-      ...nearMiss ? { corrected_command: `${command} --type ${nearMiss} \u2026` } : {}
+      ...nearMiss ? { corrected_command: `${command} --type ${nearMiss} ?` } : {}
     });
   }
   if (!ISSUE_TYPES.includes(raw)) {
-    fail(`${command}: unknown type "${raw}" \u2014 expected one of: ${ISSUE_TYPES.join(", ")}`, {
+    fail(`${command}: unknown type "${raw}" ? expected one of: ${ISSUE_TYPES.join(", ")}`, {
       code: ERROR_CODES.ERR_BAD_ENUM,
       offending_flag: "--type",
       expected: [...ISSUE_TYPES]
@@ -31356,9 +32474,9 @@ function resolveCreateSurface(opts) {
 function surfaceWaived() {
   return rawFlag("--no-surface");
 }
-var issue = program2.command("issue").description("issues \u2014 reliable create with structured output");
+var issue = program2.command("issue").description("issues ? reliable create with structured output");
 withExamples(mutating(
-  issue.command("create").description("create an issue (type \u2192 label) and print {number,url,label} JSON").addOption(new Option("--type <type>", "bug | feature | task (sets the matching label; required unless --batch)").choices([...ISSUE_TYPES])).option("--title <title>", "issue title").option("--title-file <path|->", "read the issue title from a UTF-8 file, or from stdin with -").option("--body <body>", "issue body (markdown)").option("--body-file <path|->", "read issue body from a UTF-8 file. `-` (stdin) needs a heredoc, which the agent inline-body guard denies (#1473/#2125) \u2014 prefer a real path; a title with backticks needs --title-file for the same reason (#3381)").option("--priority <priority>", "urgent | high | medium | low (defaults to medium; sets the board Priority field only \u2014 never a priority:* label, #416)").option("--repo <owner/repo>", "target repo (defaults to the current repo)").option("--label <label...>", "extra label(s) to attach (repeatable; auto-created if missing)").option("--surface <surface>", "issue surface, with or without the surface: prefix (#3789). Required when the target repo runs the one-surface-label board rule; any value satisfies it, so this is not a closed enum").option("--no-surface", "file without a surface label on a repo that requires one \u2014 for a genuinely exempt filing (e.g. a coop proof issue that spans every surface)").option("--parent <ref>", "file as a native sub-issue of this parent (#123, owner/repo#123, or URL)").option("--no-related", "skip the auto related-issues comment"),
+  issue.command("create").description("create an issue (type ? label) and print {number,url,label} JSON").addOption(new Option("--type <type>", "bug | feature | task (sets the matching label; required unless --batch)").choices([...ISSUE_TYPES])).option("--title <title>", "issue title").option("--title-file <path|->", "read the issue title from a UTF-8 file, or from stdin with -").option("--body <body>", "issue body (markdown)").option("--body-file <path|->", "read issue body from a UTF-8 file. `-` (stdin) needs a heredoc, which the agent inline-body guard denies (#1473/#2125) ? prefer a real path; a title with backticks needs --title-file for the same reason (#3381)").option("--priority <priority>", "urgent | high | medium | low (defaults to medium; sets the board Priority field only ? never a priority:* label, #416)").option("--repo <owner/repo>", "target repo (defaults to the current repo)").option("--label <label...>", "extra label(s) to attach (repeatable; auto-created if missing)").option("--surface <surface>", "issue surface, with or without the surface: prefix (#3789). Required when the target repo runs the one-surface-label board rule; any value satisfies it, so this is not a closed enum").option("--no-surface", "file without a surface label on a repo that requires one ? for a genuinely exempt filing (e.g. a coop proof issue that spans every surface)").option("--parent <ref>", "file as a native sub-issue of this parent (#123, owner/repo#123, or URL)").option("--no-related", "skip the auto related-issues comment"),
   // --dry-run/--validate-only plan: resolve the same title source and validate the same type, priority,
   // and surface contract as the real action. A plan that echoes the title-file PATH instead of its value
   // is not a plan of the mutation that will run (#3914).
@@ -31425,7 +32543,7 @@ withExamples(mutating(
     }
     targetRepo2 = await resolveRepo(o.repo);
     if (!targetRepo2) {
-      return fail("issue create: could not resolve the target repo \u2014 run inside a git checkout or pass --repo <owner/repo>");
+      return fail("issue create: could not resolve the target repo ? run inside a git checkout or pass --repo <owner/repo>");
     }
     args = buildIssueArgs({
       type: issueType,
@@ -31454,7 +32572,7 @@ withExamples(mutating(
         labels: extraLabels.length ? extraLabels : void 0
       });
       process.stderr.write(
-        `warning: --surface ${surfaceFlagLabel} was dropped \u2014 ${targetRepo2} defines no surface:* labels, and creating one here would switch the one-surface-label rule on for every later filing in it. Use --label ${surfaceFlagLabel} if you really mean to start that taxonomy.
+        `warning: --surface ${surfaceFlagLabel} was dropped ? ${targetRepo2} defines no surface:* labels, and creating one here would switch the one-surface-label rule on for every later filing in it. Use --label ${surfaceFlagLabel} if you really mean to start that taxonomy.
 `
       );
     }
@@ -31503,7 +32621,7 @@ async function readParentField(number, repo) {
   }
   return resolveParentField(payload);
 }
-issue.command("view <number>").description('read an issue as structured JSON \u2014 the mmi-cli path for non-board issue reads (#2347). --comments folds in every comment; --context also adds linkedPrs + children (the one-shot "load the whole item" read, #2894)').option("--repo <owner/repo>", "target repo (defaults to the current repo)").option("--json [fields...]", 'gh --json field list (overrides the default field set). Accepts commas, spaces, or repeated --json flags \u2014 in PowerShell an unquoted comma list is an array literal, so QUOTE it: --json "number,title,body,url"').option("--comments", 'include every comment (body + comments in one call) \u2014 the agentic "read the whole item before working it" read (#2894)').option("--context", "full working context in one call: implies --comments and also adds linkedPrs and, for an epic, a children summary (#2894)").action(async (number, o) => {
+issue.command("view <number>").description('read an issue as structured JSON ? the mmi-cli path for non-board issue reads (#2347). --comments folds in every comment; --context also adds linkedPrs + children (the one-shot "load the whole item" read, #2894)').option("--repo <owner/repo>", "target repo (defaults to the current repo)").option("--json [fields...]", 'gh --json field list (overrides the default field set). Accepts commas, spaces, or repeated --json flags ? in PowerShell an unquoted comma list is an array literal, so QUOTE it: --json "number,title,body,url"').option("--comments", 'include every comment (body + comments in one call) ? the agentic "read the whole item before working it" read (#2894)').option("--context", "full working context in one call: implies --comments and also adds linkedPrs and, for an epic, a children summary (#2894)").action(async (number, o) => {
   const n = Number(number);
   if (!Number.isInteger(n) || n <= 0) return fail("issue view: <number> must be a positive integer");
   const repo = await resolveRepo(o.repo);
@@ -31597,7 +32715,7 @@ jsonParity(issue.command("comment <ref>").description("post a Markdown comment t
     return fail(`issue comment: ${e.message}`);
   }
   const repo = await resolveRepo(parsed.repo ?? o.repo);
-  if (!repo) return fail("issue comment: could not resolve repo \u2014 pass --repo owner/repo");
+  if (!repo) return fail("issue comment: could not resolve repo ? pass --repo owner/repo");
   try {
     const result = await postIssueComment(defaultGitHubClient(), { ref, defaultRepo: repo, body });
     console.log(JSON.stringify(result));
@@ -31606,7 +32724,7 @@ jsonParity(issue.command("comment <ref>").description("post a Markdown comment t
     return failGraceful(`issue comment: ${(err.stderr || err.message || String(e)).trim()}`);
   }
 });
-jsonParity(issue.command("check <ref>").description("tick (or with --off untick) a task-list checkbox in an issue/epic body by its item text and print {number,repo,item,checked,changed} JSON").requiredOption("--item <text>", "the checklist item to match \u2014 exact item text, else a unique substring").option("--off", "untick the item ([x] \u2192 [ ]) instead of ticking it").option("--repo <owner/repo>", "repo for a bare ref (defaults to the current repo)")).action(async (ref, o) => {
+jsonParity(issue.command("check <ref>").description("tick (or with --off untick) a task-list checkbox in an issue/epic body by its item text and print {number,repo,item,checked,changed} JSON").requiredOption("--item <text>", "the checklist item to match ? exact item text, else a unique substring").option("--off", "untick the item ([x] ? [ ]) instead of ticking it").option("--repo <owner/repo>", "repo for a bare ref (defaults to the current repo)")).action(async (ref, o) => {
   let parsed;
   try {
     parsed = parseIssueRef(ref);
@@ -31614,7 +32732,7 @@ jsonParity(issue.command("check <ref>").description("tick (or with --off untick)
     return fail(`issue check: ${e.message}`);
   }
   const repo = await resolveRepo(parsed.repo ?? o.repo);
-  if (!repo) return fail("issue check: could not resolve repo \u2014 pass --repo owner/repo");
+  if (!repo) return fail("issue check: could not resolve repo ? pass --repo owner/repo");
   const checked = o.off !== true;
   let body;
   try {
@@ -31627,7 +32745,7 @@ jsonParity(issue.command("check <ref>").description("tick (or with --off untick)
   if (!result.ok) {
     if (result.reason === "ambiguous") {
       const list = result.matches.map((m) => `  - ${m.text}`).join("\n");
-      return fail(`issue check: "${o.item}" matches ${result.matches.length} checklist items in ${repo}#${parsed.number} \u2014 narrow the text:
+      return fail(`issue check: "${o.item}" matches ${result.matches.length} checklist items in ${repo}#${parsed.number} ? narrow the text:
 ${list}`);
     }
     return fail(`issue check: no checklist item matching "${o.item}" in ${repo}#${parsed.number}`);
@@ -31646,7 +32764,7 @@ ${list}`);
   }
   console.log(JSON.stringify({ number: parsed.number, repo, item: result.item.text, checked, changed: true }));
 });
-program2.command("report").description("file a friction report on the Hub board (Hub session auth, dedups open reports) and print {number,url} JSON").option("--title <title>", "one-line friction summary").option("--title-file <path|->", "read the friction summary from a UTF-8 file, or from stdin with -").option("--body <body>", "report body (markdown)").option("--body-file <path|->", "read report body from a UTF-8 file, or from stdin with -").addOption(new Option("--type <type>", "bug | feature | task (sets the matching label)").default("task").choices([...ISSUE_TYPES])).option("--priority <priority>", "urgent | high | medium | low (defaults to medium; sets the board Priority field only, #416)").option("--repo <owner/repo>", 'attribute the report to a different source repo than the current checkout for the "Filed via..." footer (rare \u2014 usually auto-detected; every report always lands on the org Hub, never an alternate target, #263)').option("--force", "file a new issue even when an open report looks like a duplicate").option("--json", "machine-readable output (already the default \u2014 report always prints JSON; #682)").action(async (o) => {
+program2.command("report").description("file a friction report on the Hub board (Hub session auth, dedups open reports) and print {number,url} JSON").option("--title <title>", "one-line friction summary").option("--title-file <path|->", "read the friction summary from a UTF-8 file, or from stdin with -").option("--body <body>", "report body (markdown)").option("--body-file <path|->", "read report body from a UTF-8 file, or from stdin with -").addOption(new Option("--type <type>", "bug | feature | task (sets the matching label)").default("task").choices([...ISSUE_TYPES])).option("--priority <priority>", "urgent | high | medium | low (defaults to medium; sets the board Priority field only, #416)").option("--repo <owner/repo>", 'attribute the report to a different source repo than the current checkout for the "Filed via..." footer (rare ? usually auto-detected; every report always lands on the org Hub, never an alternate target, #263)').option("--force", "file a new issue even when an open report looks like a duplicate").option("--json", "machine-readable output (already the default ? report always prints JSON; #682)").action(async (o) => {
   let body;
   let priority;
   let title;
@@ -31656,7 +32774,7 @@ program2.command("report").description("file a friction report on the Hub board
     body = await resolveIssueBody({ body: o.body, bodyFile: o.bodyFile }, { readFile: import_promises11.readFile, readStdin });
     priority = resolveCreatePriority(o.priority, "report");
     if (!ISSUE_TYPES.includes(o.type)) {
-      throw new Error(`unknown issue type "${o.type}" \u2014 expected one of: ${ISSUE_TYPES.join(", ")}`);
+      throw new Error(`unknown issue type "${o.type}" ? expected one of: ${ISSUE_TYPES.join(", ")}`);
     }
   } catch (e) {
     const m = e.message;
@@ -31693,7 +32811,7 @@ async function resolvePluginSha() {
     return void 0;
   }
 }
-program2.command("skill-lesson").description("file a skill-lesson on the Hub board (GitHub auth, dedups open lessons) and print {number,url} JSON").addOption(new Option("--skill <name>", `which skill misfired (${SKILL_NAMES.join(" | ")})`).makeOptionMandatory().choices([...SKILL_NAMES])).option("--title <title>", "one-line summary of what misfired").option("--title-file <path|->", "read the one-line summary from a UTF-8 file, or from stdin with -").option("--body <body>", "lesson body: what misfired, the evidence, and the proposed amendment (markdown)").option("--body-file <path|->", "read the lesson body from a UTF-8 file, or from stdin with -").option("--priority <priority>", "urgent | high | medium | low (defaults to medium; sets the board Priority field only, #416)").option("--repo <owner/repo>", `target repo (defaults to the org Hub: ${HUB_REPO3})`).option("--force", "file a new issue even when an open lesson looks like a duplicate").option("--json", "machine-readable output (already the default \u2014 skill-lesson always prints JSON)").action(async (o) => {
+program2.command("skill-lesson").description("file a skill-lesson on the Hub board (GitHub auth, dedups open lessons) and print {number,url} JSON").addOption(new Option("--skill <name>", `which skill misfired (${SKILL_NAMES.join(" | ")})`).makeOptionMandatory().choices([...SKILL_NAMES])).option("--title <title>", "one-line summary of what misfired").option("--title-file <path|->", "read the one-line summary from a UTF-8 file, or from stdin with -").option("--body <body>", "lesson body: what misfired, the evidence, and the proposed amendment (markdown)").option("--body-file <path|->", "read the lesson body from a UTF-8 file, or from stdin with -").option("--priority <priority>", "urgent | high | medium | low (defaults to medium; sets the board Priority field only, #416)").option("--repo <owner/repo>", `target repo (defaults to the org Hub: ${HUB_REPO3})`).option("--force", "file a new issue even when an open lesson looks like a duplicate").option("--json", "machine-readable output (already the default ? skill-lesson always prints JSON)").action(async (o) => {
   const targetRepo2 = o.repo ?? HUB_REPO3;
   const sourceRepo = await resolveRepo(void 0);
   const pluginSha = await resolvePluginSha();
@@ -31748,7 +32866,7 @@ program2.command("skill-lesson").description("file a skill-lesson on the Hub boa
     repo: targetRepo2,
     labels: [SKILL_LESSON_LABEL],
     command: "skill-lesson",
-    waiver: { reason: "tooling lesson spans product surfaces \u2014 coop-proof class (#3789)" }
+    waiver: { reason: "tooling lesson spans product surfaces ? coop-proof class (#3789)" }
   });
   if (surfaceWarn) process.stderr.write(`${surfaceWarn}
 `);
@@ -31760,7 +32878,7 @@ program2.command("skill-lesson").description("file a skill-lesson on the Hub boa
   const { projectItemId, onBoard } = await attachToProject(created.number, targetRepo2, priority);
   console.log(JSON.stringify({ ...created, deduped: false, label: SKILL_LESSON_LABEL, skill, priority, projectItemId, onBoard }));
 });
-var pr = program2.command("pr").description("pull requests \u2014 reliable create with structured output");
+var pr = program2.command("pr").description("pull requests ? reliable create with structured output");
 withExamples(pr.command("create").description("create a PR and print {number,url} JSON").option("--title <title>", "PR title").option("--title-file <path|->", "read the PR title from a UTF-8 file, or from stdin with -").option("--body <body>", "PR body (markdown)").option("--body-file <path|->", "read PR body from a UTF-8 file, or from stdin with -").option("--base <branch>", "base branch (defaults to the repo default)").option("--head <branch>", "head branch (defaults to the current branch)").option("--repo <owner/repo>", "target repo (defaults to the current repo)").option("--draft", "open the PR in draft state (#2667)").option("--json", "machine-readable output (default; accepted for parity)").action(async (o) => {
   let body;
   let title;
@@ -31773,7 +32891,7 @@ withExamples(pr.command("create").description("create a PR and print {number,url
   body = normalizeClosingDirectives(body);
   const docsCheck = await checkDocsIndexAtHead({ repo: o.repo, head: o.head }, createPrCreateDocsIndexDeps());
   if (docsCheck && !docsCheck.ok) {
-    return fail(`pr create: ${docsCheck.detail} \u2014 ${docsCheck.fix}`);
+    return fail(`pr create: ${docsCheck.detail} ? ${docsCheck.fix}`);
   }
   const created = await ghCreate(buildPrArgs({ title, body, base: o.base, head: o.head, repo: o.repo, draft: o.draft }));
   console.log(JSON.stringify(created));
@@ -31784,7 +32902,7 @@ withExamples(pr.command("create").description("create a PR and print {number,url
   "--head and --base default to the current branch and the repo default; only pass them to override.",
   "Use --body-file for multiline PR bodies instead of shell-escaped inline markdown."
 ]);
-pr.command("view <number>").description("read a PR as structured JSON (merged state, head/base, URL, merge commit) \u2014 the mmi-cli read path (#2347). --comments folds in every comment; --context also adds linkedIssues (the issues it closes/references, #2894)").option("--repo <owner/repo>", "target repo (defaults to the current repo)").option("--json [fields...]", 'gh --json field list (overrides the default field set). Accepts commas, spaces, or repeated --json flags \u2014 in PowerShell an unquoted comma list is an array literal, so QUOTE it: --json "state,baseRefName,mergeCommit"').option("--comments", "include every comment (body + comments in one call) \u2014 read the whole PR before landing it (#2894)").option("--context", "full working context in one call: implies --comments and also adds linkedIssues (the issues the PR closes/references) (#2894)").action(async (number, o) => {
+pr.command("view <number>").description("read a PR as structured JSON (merged state, head/base, URL, merge commit) ? the mmi-cli read path (#2347). --comments folds in every comment; --context also adds linkedIssues (the issues it closes/references, #2894)").option("--repo <owner/repo>", "target repo (defaults to the current repo)").option("--json [fields...]", 'gh --json field list (overrides the default field set). Accepts commas, spaces, or repeated --json flags ? in PowerShell an unquoted comma list is an array literal, so QUOTE it: --json "state,baseRefName,mergeCommit"').option("--comments", "include every comment (body + comments in one call) ? read the whole PR before landing it (#2894)").option("--context", "full working context in one call: implies --comments and also adds linkedIssues (the issues the PR closes/references) (#2894)").action(async (number, o) => {
   const n = Number(number);
   if (!Number.isInteger(n) || n <= 0) return fail("pr view: <number> must be a positive integer");
   const repo = await resolveRepo(o.repo);
@@ -31805,11 +32923,11 @@ pr.command("view <number>").description("read a PR as structured JSON (merged st
   }
 });
 async function listCiWorkflowPaths(cwd = process.cwd()) {
-  const wfDir = (0, import_node_path35.join)(cwd, ".github", "workflows");
-  if (!(0, import_node_fs36.existsSync)(wfDir)) return [];
-  return (0, import_node_fs36.readdirSync)(wfDir).filter((name) => /\.(ya?ml)$/i.test(name)).filter((name) => {
+  const wfDir = (0, import_node_path38.join)(cwd, ".github", "workflows");
+  if (!(0, import_node_fs39.existsSync)(wfDir)) return [];
+  return (0, import_node_fs39.readdirSync)(wfDir).filter((name) => /\.(ya?ml)$/i.test(name)).filter((name) => {
     try {
-      return workflowReportsPrChecks((0, import_node_fs36.readFileSync)((0, import_node_path35.join)(wfDir, name), "utf8"));
+      return workflowReportsPrChecks((0, import_node_fs39.readFileSync)((0, import_node_path38.join)(wfDir, name), "utf8"));
     } catch {
       return true;
     }
@@ -31841,16 +32959,16 @@ function ciAuditDeps() {
     // gate re-seed step is skipped gracefully rather than failing mid-run.
     readSeedFile: (path2) => {
       if (!root) return null;
-      const fullPath = (0, import_node_path35.join)(root, path2);
-      return (0, import_node_fs36.existsSync)(fullPath) ? (0, import_node_fs36.readFileSync)(fullPath, "utf8") : null;
+      const fullPath = (0, import_node_path38.join)(root, path2);
+      return (0, import_node_fs39.existsSync)(fullPath) ? (0, import_node_fs39.readFileSync)(fullPath, "utf8") : null;
     }
   };
 }
 function hubRoot() {
-  const fromPkg = (0, import_node_path35.join)(__dirname, "..", "..");
+  const fromPkg = (0, import_node_path38.join)(__dirname, "..", "..");
   const marker = "skills/bootstrap/seeds/manifest.json";
-  if ((0, import_node_fs36.existsSync)((0, import_node_path35.join)(fromPkg, marker))) return fromPkg;
-  if ((0, import_node_fs36.existsSync)((0, import_node_path35.join)(process.cwd(), marker))) return process.cwd();
+  if ((0, import_node_fs39.existsSync)((0, import_node_path38.join)(fromPkg, marker))) return fromPkg;
+  if ((0, import_node_fs39.existsSync)((0, import_node_path38.join)(process.cwd(), marker))) return process.cwd();
   return null;
 }
 pr.command("ci-policy").description("report merge CI policy: wait-for-checks vs no-ci (for grind/build agents)").option("--json", "machine-readable output").option("--repo <owner/repo>", "target repo (defaults to the current checkout)").action(async (o) => {
@@ -31858,7 +32976,7 @@ pr.command("ci-policy").description("report merge CI policy: wait-for-checks vs
   if (o.json) return printLine(JSON.stringify(result));
   printLine(`merge CI policy: ${result.policy} (${result.reason})`);
 });
-pr.command("checks-wait <number>").description(`bounded wait for PR checks; skips immediately on no-ci repos (#1432), fails immediately on a CONFLICTING PR \u2014 GitHub never queues checks for one (#2970). REST-only polling with a pool floor (#3024). Default budget ${PR_CHECKS_TIMEOUT_MS / 6e4}m; --timeout raises it. Exit 1 = a check FAILED or the PR is CONFLICTING, exit ${PR_CHECKS_TIMEOUT_EXIT_CODE} = the wait window expired or the API pool ran dry (re-arm)`).option("--json", "machine-readable output").option("--repo <owner/repo>", "target repo (defaults to the current repo)").option("--timeout <minutes>", `wait budget in minutes (default ${PR_CHECKS_TIMEOUT_MS / 6e4}) \u2014 raise it for serial self-hosted e2e queues`).action(async (number, o) => {
+pr.command("checks-wait <number>").description(`bounded wait for PR checks; skips immediately on no-ci repos (#1432), fails immediately on a CONFLICTING PR ? GitHub never queues checks for one (#2970). REST-only polling with a pool floor (#3024). Default budget ${PR_CHECKS_TIMEOUT_MS / 6e4}m; --timeout raises it. Exit 1 = a check FAILED or the PR is CONFLICTING, exit ${PR_CHECKS_TIMEOUT_EXIT_CODE} = the wait window expired or the API pool ran dry (re-arm)`).option("--json", "machine-readable output").option("--repo <owner/repo>", "target repo (defaults to the current repo)").option("--timeout <minutes>", `wait budget in minutes (default ${PR_CHECKS_TIMEOUT_MS / 6e4}) ? raise it for serial self-hosted e2e queues`).action(async (number, o) => {
   let timeoutMs;
   if (o.timeout !== void 0) {
     const minutes = Number(o.timeout);
@@ -31883,24 +33001,27 @@ pr.command("checks-wait <number>").description(`bounded wait for PR checks; skip
     timeoutMs,
     // Liveness on stderr, one line per poll. A silent bounded wait is indistinguishable from a hang, and
     // an agent harness kills it on its own (shorter) deadline before the verdict ever prints (#2940).
-    progress: ({ state, elapsedMs, remainingMs }) => console.warn(`pr checks-wait: ${state} \u2014 ${Math.round(elapsedMs / 1e3)}s elapsed, ${Math.round(remainingMs / 6e4)}m left`)
+    progress: ({ state, elapsedMs, remainingMs }) => console.warn(`pr checks-wait: ${state} ? ${Math.round(elapsedMs / 1e3)}s elapsed, ${Math.round(remainingMs / 6e4)}m left`)
   });
   if (o.json) printLine(JSON.stringify(result));
   else if (result.status === "conflicting") {
-    printLine(`pr checks-wait: conflicting \u2014 ${result.reason}`);
+    printLine(`pr checks-wait: conflicting ? ${result.reason}`);
   } else if (result.status === "timeout") {
-    printLine(`pr checks-wait: timeout \u2014 waited ${Math.round((result.waitedMs ?? 0) / 6e4)}m, last state: ${result.detail ?? "pending"}. No check failed; re-run to keep waiting, or pass --timeout <minutes>.`);
+    const stuckQueuing = /no-checks-reported/i.test(result.detail ?? "");
+    printLine(
+      `pr checks-wait: timeout ? waited ${Math.round((result.waitedMs ?? 0) / 6e4)}m, last state: ${result.detail ?? "pending"}. No check failed; re-run to keep waiting, or pass --timeout <minutes>.` + (stuckQueuing ? " Tip: jobs never appeared ? mmi-live may be saturated or Actions may be failing before checkout; check runner health (docs/Guides/gh-runner-runbook.md) and re-run the workflow." : "")
+    );
   } else if (result.status === "rate-limited") {
-    printLine(`pr checks-wait: rate-limited \u2014 ${result.reason ?? "REST pool below floor"}. No check failed; re-run after the pool resets.`);
+    printLine(`pr checks-wait: rate-limited ? ${result.reason ?? "REST pool below floor"}. No check failed; re-run after the pool resets.`);
   } else if (result.detail === "runner-infra") {
-    printLine(`pr checks-wait: failure (runner infrastructure, NOT a test failure) \u2014 ${result.reason}`);
+    printLine(`pr checks-wait: failure (runner infrastructure, NOT a test failure) ? ${result.reason}`);
   } else if (result.detail === "stale-head") {
-    printLine(`pr checks-wait: failure (stale PR head, NOT a test failure) \u2014 ${result.reason}`);
-  } else printLine(`pr checks-wait: ${result.status}${result.reason ? ` \u2014 ${result.reason}` : ""}${result.detail ? ` (${result.detail})` : ""}`);
+    printLine(`pr checks-wait: failure (stale PR head, NOT a test failure) ? ${result.reason}`);
+  } else printLine(`pr checks-wait: ${result.status}${result.reason ? ` ? ${result.reason}` : ""}${result.detail ? ` (${result.detail})` : ""}`);
   if (result.status === "failure" || result.status === "conflicting") process.exitCode = 1;
   if (result.status === "timeout" || result.status === "rate-limited") process.exitCode = PR_CHECKS_TIMEOUT_EXIT_CODE;
 });
-pr.command("land <number>").description("agent merge path (#1440): train probe \u2192 checks-wait \u2192 merge --auto \u2192 poll enqueued \u2014 development PRs only").option("--json", "machine-readable output").option("--repo <owner/repo>", "target repo (defaults to the PR repo)").option("--no-require-train", "skip train-authority preflight (not recommended for autonomous agents)").option("--preserve-worktree", "after merge, keep the local PR worktree/stage/branch for an active batch (#1888)").option("--force", "acknowledge and land past a remaining prunable/severe scratch housekeeping block (advisory kept plans/ never blocks, #3012) or a negated-closing-keyword refusal (#3718)").action(async (number, o) => {
+pr.command("land <number>").description("agent merge path (#1440): train probe ? checks-wait ? merge --auto ? poll enqueued ? development PRs only").option("--json", "machine-readable output").option("--repo <owner/repo>", "target repo (defaults to the PR repo)").option("--no-require-train", "skip train-authority preflight (not recommended for autonomous agents)").option("--preserve-worktree", "after merge, keep the local PR worktree/stage/branch for an active batch (#1888)").option("--force", "acknowledge and land past a remaining prunable/severe scratch housekeeping block (advisory kept plans/ never blocks, #3012) or a negated-closing-keyword refusal (#3718)").action(async (number, o) => {
   const repoArgs = o.repo ? ["--repo", o.repo] : [];
   const startingPath = (await execFileP2("git", ["rev-parse", "--show-toplevel"], { timeout: GIT_TIMEOUT_MS }).catch(() => ({ stdout: "" }))).stdout.trim();
   assertPrMergeHousekeepingClean(startingPath || process.cwd(), "pr land", { force: o.force });
@@ -31926,8 +33047,8 @@ pr.command("land <number>").description("agent merge path (#1440): train probe \
       } catch {
       }
       if (isPromotionBase(base, track)) {
-        const shape = track ? `${track} track` : "unresolved track \u2014 strict reading";
-        throw new Error(`pr land: base branch ${base} is a promotion target (${shape}) \u2014 promotion merges stay human-only`);
+        const shape = track ? `${track} track` : "unresolved track ? strict reading";
+        throw new Error(`pr land: base branch ${base} is a promotion target (${shape}) ? promotion merges stay human-only`);
       }
       return repo;
     },
@@ -31935,23 +33056,23 @@ pr.command("land <number>").description("agent merge path (#1440): train probe \
     resolveCiPolicy: (repo) => resolveRepoMergeCiPolicy(repo, ciAuditDeps()),
     waitForChecks: (prNumber, repo) => waitForPrChecks({
       resolvePolicy: () => resolveRepoMergeCiPolicy(repo, ciAuditDeps()),
-      // #3024: REST-only wait loop — runPrLand's resolveRepo already guarantees `repo` is set.
+      // #3024: REST-only wait loop ? runPrLand's resolveRepo already guarantees `repo` is set.
       pollChecks: () => pollRestPrChecks(prNumber, repo),
       // #2970: `pr land` only ever lands PRs based on development (resolveRepo above already rejects any
       // other base), so the fast-fail message's base branch is always 'development' here.
       pollMergeable: () => pollRestPrMergeable(prNumber, repo),
       pollRateLimit: () => fetchRestCorePool(),
-      // #3388: `pr land` is the batch path — the one most likely to self-DOS the shared runner and
+      // #3388: `pr land` is the batch path ? the one most likely to self-DOS the shared runner and
       // then read its own wall-clock kill as a broken diff.
       diagnoseFailure: () => diagnoseFailedRestChecks(prNumber, repo),
       baseBranch: "development",
       sleep: (ms) => new Promise((resolve5) => setTimeout(resolve5, ms)),
       log: (message) => console.warn(message),
-      // `pr land` inherits the same (raised) checks budget, so it needs the same liveness — otherwise the
+      // `pr land` inherits the same (raised) checks budget, so it needs the same liveness ? otherwise the
       // 30m wait is SILENT and reads exactly like the hang #2940 was filed about, only three times longer.
-      progress: ({ state, elapsedMs, remainingMs }) => console.warn(`pr land: waiting on checks \u2014 ${state}, ${Math.round(elapsedMs / 1e3)}s elapsed, ${Math.round(remainingMs / 6e4)}m left`)
+      progress: ({ state, elapsedMs, remainingMs }) => console.warn(`pr land: waiting on checks ? ${state}, ${Math.round(elapsedMs / 1e3)}s elapsed, ${Math.round(remainingMs / 6e4)}m left`)
     }),
-    // #2425: re-probe used ONLY to decide whether a failed `gh pr merge --auto` is worth retrying — a
+    // #2425: re-probe used ONLY to decide whether a failed `gh pr merge --auto` is worth retrying ? a
     // fresh read of state/mergeable/checks, independent of the merge call's own (possibly stale) error.
     probeMergeReady: async (prNumber, repo) => {
       const [snapshot, checks] = await Promise.all([
@@ -31981,7 +33102,7 @@ pr.command("land <number>").description("agent merge path (#1440): train probe \
   });
   if (result.status !== "failed") {
     const repoFlag = result.repo ? ` --repo ${result.repo}` : "";
-    console.warn(`pr land: merge confirmed; cleanup pending \u2014 if this process is interrupted, resume with: mmi-cli pr merge ${number}${repoFlag} --squash`);
+    console.warn(`pr land: merge confirmed; cleanup pending ? if this process is interrupted, resume with: mmi-cli pr merge ${number}${repoFlag} --squash`);
   }
   if (result.status !== "failed") {
     try {
@@ -32010,13 +33131,13 @@ pr.command("land <number>").description("agent merge path (#1440): train probe \
   }
   if (o.json) printLine(JSON.stringify(result));
   else {
-    printLine(`pr land: ${result.status}${result.error ? ` \u2014 ${result.error}` : ""}`);
+    printLine(`pr land: ${result.status}${result.error ? ` ? ${result.error}` : ""}`);
     for (const line of renderPrLandCleanupLines(result.cleanup)) printLine(line);
     if (result.cleanupError) printLine(`pr land cleanup: ${result.cleanupError}`);
   }
   if (result.status === "failed" || result.cleanupError) process.exitCode = 1;
 });
-jsonParity(pr.command("merge <number>").description("merge a PR (squash by default) and clean up its branch + worktree \u2014 no leftover local branch; on no-ci repos run pr ci-policy / checks-wait first (#1432)").option("--squash", "squash merge (default)").option("--merge", "create a merge commit").option("--rebase", "rebase merge").option("--repo <owner/repo>", "target repo (defaults to the current repo)").option("--auto", "enable auto-merge \u2014 merge once the base-branch policy is satisfied (use for policy-gated repos)").option("--wait", `wait for checks to reach a terminal passing verdict before merging (default budget ${PR_CHECKS_TIMEOUT_MS / 6e4}m)`).option("--preserve-worktree", "keep the local PR worktree/stage/branch for an active multi-issue batch (#1888)").option("--force", "acknowledge and merge past a remaining prunable/severe scratch housekeeping block (advisory kept plans/ never blocks, #3012) or a negated-closing-keyword refusal (#3718)")).action(async (number, o) => {
+jsonParity(pr.command("merge <number>").description("merge a PR (squash by default) and clean up its branch + worktree ? no leftover local branch; on no-ci repos run pr ci-policy / checks-wait first (#1432)").option("--squash", "squash merge (default)").option("--merge", "create a merge commit").option("--rebase", "rebase merge").option("--repo <owner/repo>", "target repo (defaults to the current repo)").option("--auto", "enable auto-merge ? merge once the base-branch policy is satisfied (use for policy-gated repos)").option("--wait", `wait for checks to reach a terminal passing verdict before merging (default budget ${PR_CHECKS_TIMEOUT_MS / 6e4}m)`).option("--preserve-worktree", "keep the local PR worktree/stage/branch for an active multi-issue batch (#1888)").option("--force", "acknowledge and merge past a remaining prunable/severe scratch housekeeping block (advisory kept plans/ never blocks, #3012) or a negated-closing-keyword refusal (#3718)")).action(async (number, o) => {
   const method = o.rebase ? "--rebase" : o.merge ? "--merge" : "--squash";
   const repoArgs = o.repo ? ["--repo", o.repo] : [];
   const repoForPostCleanup = await resolveRepo(o.repo) ?? o.repo;
@@ -32049,10 +33170,10 @@ jsonParity(pr.command("merge <number>").description("merge a PR (squash by defau
       baseBranch,
       sleep: (ms) => new Promise((resolve5) => setTimeout(resolve5, ms)),
       log: (message) => console.warn(message),
-      progress: ({ state, elapsedMs, remainingMs }) => console.warn(`pr merge: --wait checks \u2014 ${state}, ${Math.round(elapsedMs / 1e3)}s elapsed, ${Math.round(remainingMs / 6e4)}m left`)
+      progress: ({ state, elapsedMs, remainingMs }) => console.warn(`pr merge: --wait checks ? ${state}, ${Math.round(elapsedMs / 1e3)}s elapsed, ${Math.round(remainingMs / 6e4)}m left`)
     });
     if (wait.status !== "success" && wait.status !== "skipped") {
-      console.warn(`pr merge: --wait stopped before merge \u2014 ${wait.status}${wait.reason ? `: ${wait.reason}` : ""}${wait.detail ? ` (${wait.detail})` : ""}`);
+      console.warn(`pr merge: --wait stopped before merge ? ${wait.status}${wait.reason ? `: ${wait.reason}` : ""}${wait.detail ? ` (${wait.detail})` : ""}`);
       process.exitCode = wait.status === "timeout" || wait.status === "rate-limited" ? PR_CHECKS_TIMEOUT_EXIT_CODE : 1;
       return;
     }
@@ -32091,7 +33212,7 @@ jsonParity(pr.command("merge <number>").description("merge a PR (squash by defau
         return;
       }
       if (!o.auto && basePolicyBlocksImmediateMerge(message)) {
-        console.warn(`pr merge: the base-branch policy blocks an immediate merge \u2014 upgrading to --auto (merges once required checks pass).`);
+        console.warn(`pr merge: the base-branch policy blocks an immediate merge ? upgrading to --auto (merges once required checks pass).`);
         upgradedToAuto = true;
         await execFileP2("gh", buildPrMergeArgs({ number, repoArgs, method, auto: true, deleteBranch: !headIsProtected, bodyFile }), { timeout: GH_MUTATION_TIMEOUT_MS }).catch((e2) => {
           const m2 = String(e2.message || "");
@@ -32122,7 +33243,7 @@ jsonParity(pr.command("merge <number>").description("merge a PR (squash by defau
     const state = stateRead.ok ? stateRead.state : "";
     const enqueued = describePrMergeEnqueuedReason(await pollGhPrChecks(number, repoArgs).catch(() => void 0));
     console.log(JSON.stringify({ mergeStatus: "auto-merge-enqueued", enqueuedReason: enqueued.reason, pr: number, branch: headRef, state: state || "unknown", upgradedToAuto: upgradedToAuto || void 0 }));
-    console.warn(`pr merge: PR #${number} is ENQUEUED, not merged \u2014 ${enqueued.message}.`);
+    console.warn(`pr merge: PR #${number} is ENQUEUED, not merged ? ${enqueued.message}.`);
     if (upgradedToAuto && !o.auto) {
       console.warn(`pr merge: exiting ${PR_MERGE_ENQUEUED_EXIT_CODE} so a chained command does not treat this as a completed merge.`);
       process.exitCode = PR_MERGE_ENQUEUED_EXIT_CODE;
@@ -32138,7 +33259,7 @@ jsonParity(pr.command("merge <number>").description("merge a PR (squash by defau
       state: stateRead.ok ? stateRead.state : "unknown",
       cleanupStatus: "skipped"
     }));
-    console.error(`pr merge: ${gate.message}. Nothing was deleted \u2014 re-check the PR and retry.`);
+    console.error(`pr merge: ${gate.message}. Nothing was deleted ? re-check the PR and retry.`);
     process.exitCode = 1;
     return;
   }
@@ -32158,7 +33279,7 @@ jsonParity(pr.command("merge <number>").description("merge a PR (squash by defau
     localCleanup = await cleanupPrMergeLocalBranch(headRef, {
       beforeWorktrees,
       startingPath,
-      pathExists: (p) => (0, import_node_fs36.existsSync)(p),
+      pathExists: (p) => (0, import_node_fs39.existsSync)(p),
       execGit: async (args) => (await execFileP2("git", args, { timeout: GIT_TIMEOUT_MS })).stdout,
       teardownWorktreeStage,
       deferredStore,
@@ -32232,7 +33353,7 @@ function trainApplyDeps() {
       const verdict = await fetchTrainAuthority(repo, registryClientDeps(await loadConfig()));
       return verdict.ok ? { ok: true, role: verdict.authority.role, train: verdict.authority.train } : verdict;
     },
-    // Hub-App-authority dispatch of the central tenant deploy (#953) — the Hub fires the
+    // Hub-App-authority dispatch of the central tenant deploy (#953) ? the Hub fires the
     // workflow_dispatch with its App token, so the caller needs no MMI-Hub Actions write.
     dispatchTenantDeploy: async ({ repo, stage, ref }) => {
       const res = await tenantDeploy({ repo, stage, ref }, registryClientDeps(await loadConfig()));
@@ -32241,7 +33362,7 @@ function trainApplyDeps() {
         throw new Error(`tenant deploy dispatch failed: ${detail}`);
       }
     },
-    // Hub-App-authority dispatch of the central tenant-control.yml (#1717) — the Hub fires the
+    // Hub-App-authority dispatch of the central tenant-control.yml (#1717) ? the Hub fires the
     // workflow_dispatch with its App token. Never throws for an expected rejection: it returns the dispatch
     // outcome so runTenantControl can map a 5xx (transport-failed, retryable) vs a 4xx (rejected) vs ok.
     dispatchTenantControl: async ({ repo, stage, action, lines }) => {
@@ -32257,7 +33378,7 @@ function trainApplyDeps() {
       return { ok: false, category: body?.category, error: body?.error ?? res.error };
     },
     // Hotfix-coverage guard (#958): runs against the local clone via real git. manifestPaths exempts the
-    // release version fold (#976) — a main-only commit touching ONLY the root package manifest is the
+    // release version fold (#976) ? a main-only commit touching ONLY the root package manifest is the
     // fold's version metadata, which the candidate replaces with its own. (The Hub's wider distribution
     // set never reaches this guard: the Hub is direct-track.)
     hotfixCoverage: (input) => checkHotfixCoverage({ ...input, manifestPaths: ["package.json", "package-lock.json"] }),
@@ -32292,13 +33413,13 @@ function renderDeployLine(d) {
   else if (d.runUrl) parts.push(`run ${d.runUrl}`);
   if (d.deployStatus === "success") parts.push("deploy: SUCCEEDED");
   else if (d.deployStatus === "failure") parts.push("deploy: FAILED (promotion stands; retry the deploy, do not re-tag)");
-  else if (d.runId != null) parts.push(`deploy: UNVERIFIED \u2014 dispatched, not resolved (watch: gh run watch ${d.runId} --repo mutmutco/MMI-Hub --exit-status)`);
-  else if (d.workflowRuns?.length) parts.push("deploy: UNVERIFIED \u2014 the runs above are enumerated, not resolved; watch each to conclusion before calling this release healthy (#3322)");
-  else parts.push("deploy: UNVERIFIED \u2014 no run correlated or watched; resolve every workflow run on the release SHA before calling this release healthy (#3322)");
+  else if (d.runId != null) parts.push(`deploy: UNVERIFIED ? dispatched, not resolved (watch: gh run watch ${d.runId} --repo mutmutco/MMI-Hub --exit-status)`);
+  else if (d.workflowRuns?.length) parts.push("deploy: UNVERIFIED ? the runs above are enumerated, not resolved; watch each to conclusion before calling this release healthy (#3322)");
+  else parts.push("deploy: UNVERIFIED ? no run correlated or watched; resolve every workflow run on the release SHA before calling this release healthy (#3322)");
   return parts.join("; ");
 }
 function renderReleaseResume(r) {
-  const lines = [`mmi-cli release --resume: ${r.repo} ${r.tag} (${r.tagSha.slice(0, 12)}) [${r.deployModel}] \u2014 ${r.note}`];
+  const lines = [`mmi-cli release --resume: ${r.repo} ${r.tag} (${r.tagSha.slice(0, 12)}) [${r.deployModel}] ? ${r.note}`];
   for (const step of r.steps) lines.push(`  - ${step}`);
   if (r.releaseUrl) lines.push(`  release: ${r.releaseUrl}`);
   if (r.announceNote) lines.push(`  announce: ${r.announceNote}`);
@@ -32308,23 +33429,23 @@ function renderReleaseResume(r) {
   return lines.join("\n");
 }
 function renderReleaseAbort(r) {
-  return `mmi-cli release --abort --apply: ${r.repo} ${r.tag} (${r.tagSha.slice(0, 12)}) \u2014 ${r.note}`;
+  return `mmi-cli release --abort --apply: ${r.repo} ${r.tag} (${r.tagSha.slice(0, 12)}) ? ${r.note}`;
 }
 function renderReleasePublishRetry(r) {
-  return `mmi-cli release --retry-publish: ${r.repo} ${r.tag} (${r.tagSha.slice(0, 12)}) \u2014 ${r.note}; ${r.runUrl}`;
+  return `mmi-cli release --retry-publish: ${r.repo} ${r.tag} (${r.tagSha.slice(0, 12)}) ? ${r.note}; ${r.runUrl}`;
 }
 function renderRcandResume(r) {
-  return `mmi-cli rcand --resume: promoted ${r.repo} \u2192 rc at ${r.tag} (${r.tagSha.slice(0, 12)}) [${r.deployModel}]; ${renderDeployLine(r)}; ${r.note}`;
+  return `mmi-cli rcand --resume: promoted ${r.repo} ? rc at ${r.tag} (${r.tagSha.slice(0, 12)}) [${r.deployModel}]; ${renderDeployLine(r)}; ${r.note}`;
 }
 function renderAlignment(label, alignment) {
   if (alignment.status !== "pr-pending") return `${label}: ${alignment.note}`;
   if (alignment.autoMergeEnqueued) {
     return `${label}: alignment PR #${alignment.prNumber ?? "?"} AUTO-MERGE ENQUEUED (merges when checks pass)${alignment.prUrl ? ` (${alignment.prUrl})` : ""}`;
   }
-  return `${label}: ALIGNMENT PR PENDING \u2014 land it with \`mmi-cli pr merge ${alignment.prNumber ?? "<number>"} --auto --merge\`${alignment.prUrl ? ` (${alignment.prUrl})` : ""}`;
+  return `${label}: ALIGNMENT PR PENDING ? land it with \`mmi-cli pr merge ${alignment.prNumber ?? "<number>"} --auto --merge\`${alignment.prUrl ? ` (${alignment.prUrl})` : ""}`;
 }
 function renderTrainApply(commandName, r) {
-  let base = `mmi-cli ${commandName}: promoted ${r.repo} \u2192 ${r.stage} at ${r.tag} [${r.deployModel}]; ${renderDeployLine(r)}`;
+  let base = `mmi-cli ${commandName}: promoted ${r.repo} ? ${r.stage} at ${r.tag} [${r.deployModel}]; ${renderDeployLine(r)}`;
   if (r.versionFold) base = `${base}; ${r.versionFold}`;
   if (r.resumeNote) base = `${base}; ${r.resumeNote}`;
   if (r.devNote) base = `${base}; ${r.devNote}`;
@@ -32382,16 +33503,16 @@ for (const commandName of ["rcand", "release"]) {
       return fail(`${commandName}: ${e.message}`);
     }
     if (o.ack && commandName !== "release") {
-      return fail(`${commandName}: --ack applies only to release \u2014 it overrides the rc -> main hotfix-coverage guard, which rcand does not run. Run: mmi-cli release --ack <shas>`);
+      return fail(`${commandName}: --ack applies only to release ? it overrides the rc -> main hotfix-coverage guard, which rcand does not run. Run: mmi-cli release --ack <shas>`);
     }
     if (o.dev && commandName !== "release") {
-      return fail(`${commandName}: --dev applies only to release \u2014 it ships development -> main skipping rc, which rcand cannot do. Run: mmi-cli release --dev`);
+      return fail(`${commandName}: --dev applies only to release ? it ships development -> main skipping rc, which rcand cannot do. Run: mmi-cli release --dev`);
     }
     if (o.announceSummaryFile && commandName !== "release") {
-      return fail(`${commandName}: --announce-summary-file applies only to release \u2014 rcand posts no Hub Slack announcement. Run: mmi-cli release --announce-summary-file <path>`);
+      return fail(`${commandName}: --announce-summary-file applies only to release ? rcand posts no Hub Slack announcement. Run: mmi-cli release --announce-summary-file <path>`);
     }
     if (o.abort && commandName !== "release") {
-      return fail(`${commandName}: --abort applies only to release \u2014 it rolls back a proven unpublished Hub release tag. Run: mmi-cli release --abort --apply`);
+      return fail(`${commandName}: --abort applies only to release ? it rolls back a proven unpublished Hub release tag. Run: mmi-cli release --abort --apply`);
     }
     if (o.retryPublish && commandName !== "release") {
       return fail(`${commandName}: --retry-publish applies only to release. Run: mmi-cli release --retry-publish <run-id> --apply --watch`);
@@ -32413,7 +33534,7 @@ for (const commandName of ["rcand", "release"]) {
       }
     }
     if (o.abort) {
-      if (o.resume) return fail("release: --abort and --resume are mutually exclusive \u2014 abort removes an unpublished tag while resume preserves and promotes it");
+      if (o.resume) return fail("release: --abort and --resume are mutually exclusive ? abort removes an unpublished tag while resume preserves and promotes it");
       if (!o.apply) return fail("release: --abort requires --apply after explicit approval; nothing was written");
       if (o.watch || o.announceSummaryFile || o.ack || o.dev) {
         return fail("release: --abort accepts only --apply, --repo and --json; promotion flags cannot be combined with rollback");
@@ -32430,7 +33551,7 @@ for (const commandName of ["rcand", "release"]) {
       }
     }
     if (o.resume) {
-      if (o.apply) return fail(`${commandName}: --resume and --apply are mutually exclusive \u2014 --apply cuts the NEXT version, --resume finishes the immutable tag already on origin`);
+      if (o.apply) return fail(`${commandName}: --resume and --apply are mutually exclusive ? --apply cuts the NEXT version, --resume finishes the immutable tag already on origin`);
       try {
         if (commandName === "rcand") {
           const result2 = await runRcandResume(trainApplyDeps(), { watch: o.watch });
@@ -32478,7 +33599,7 @@ for (const commandName of ["rcand", "release"]) {
             projectInfoSync = await runProjectInfoSync(result.repo, true);
           } catch (e) {
             const error = e.message;
-            projectInfoSync = { applied: false, note: `FAILED \u2014 ${error}`, error };
+            projectInfoSync = { applied: false, note: `FAILED ? ${error}`, error };
           }
         }
         const alignmentPending = result.devRollForward?.status === "pr-pending" || result.rcAlignment?.status === "pr-pending";
@@ -32533,13 +33654,13 @@ function renderHotfixRelease(r) {
     ...r.runs.map((run) => `  - ${run.workflow}: ${run.conclusion}${run.url ? ` (${run.url})` : ""}`),
     `  - ${r.verifyNote}`,
     ...r.announceNote ? [`  - announce: ${r.announceNote}`] : [],
-    `  - next: mmi-cli hotfix status ${r.tag} (no back-merge \u2014 development already has the fix; the next /release back-merge aligns the version manifests)`
+    `  - next: mmi-cli hotfix status ${r.tag} (no back-merge ? development already has the fix; the next /release back-merge aligns the version manifests)`
   ].join("\n");
 }
 function renderHotfixStatus(r) {
   return [
-    `mmi-cli hotfix status: ${r.tag} on ${r.repo} \u2014 ${r.state}`,
-    `  - branch: ${r.branchExists ? "pushed" : "absent"} \xB7 PR: ${r.pr ? `#${r.pr.number} ${r.pr.state}` : "none"} \xB7 tag: ${r.tagPushed ? "pushed" : "absent"} \xB7 Release: ${r.releaseExists ? "exists" : "absent"}`,
+    `mmi-cli hotfix status: ${r.tag} on ${r.repo} ? ${r.state}`,
+    `  - branch: ${r.branchExists ? "pushed" : "absent"} ? PR: ${r.pr ? `#${r.pr.number} ${r.pr.state}` : "none"} ? tag: ${r.tagPushed ? "pushed" : "absent"} ? Release: ${r.releaseExists ? "exists" : "absent"}`,
     ...r.runs.map((run) => `  - ${run.workflow}: ${run.conclusion}${run.url ? ` (${run.url})` : ""}`),
     `  - npm @mutmutco/cli: ${r.npmVersion}`,
     `  - next: ${r.next}`,
@@ -32555,13 +33676,13 @@ async function runHotfixSub(sub, body, json, render) {
     return failGraceful(`hotfix ${sub}: ${e.message}`);
   }
 }
-var hotfixCmd = program2.command("hotfix").description("stepwise hotfix orchestrator: start \u2192 release, with status (bare command prints the dry-run plan; no back-merge \u2014 #839)").option("--json", "machine-readable output").option("--apply", "not a verb; use the hotfix subcommands (start/release/status)").action(async (o) => {
+var hotfixCmd = program2.command("hotfix").description("stepwise hotfix orchestrator: start ? release, with status (bare command prints the dry-run plan; no back-merge ? #839)").option("--json", "machine-readable output").option("--apply", "not a verb; use the hotfix subcommands (start/release/status)").action(async (o) => {
   try {
     await requireFreshTrainCli("hotfix");
   } catch (e) {
     return fail(`hotfix: ${e.message}`);
   }
-  if (o.apply) return fail("hotfix: use the stepwise subcommands \u2014 mmi-cli hotfix start --from <pr#|sha> \xB7 release <vX.Y.Z> \xB7 status [vX.Y.Z]");
+  if (o.apply) return fail("hotfix: use the stepwise subcommands ? mmi-cli hotfix start --from <pr#|sha> ? release <vX.Y.Z> ? status [vX.Y.Z]");
   const steps = trainPlan("hotfix");
   console.log(o.json ? JSON.stringify({ command: "hotfix", steps }, null, 2) : renderSteps("mmi-cli hotfix: dry-run plan", steps));
 });
@@ -32576,7 +33697,7 @@ ci.command("audit").description("read-only fleet scan: gate workflow, ruleset co
   else console.log(renderCiAuditText(report));
   if (!report.ok) process.exitCode = 1;
 });
-ci.command("reconcile").description("audit + optionally apply merge settings and product ruleset activation (master-admin)").option("--json", "machine-readable output").option("--repo <owner/repo>", "reconcile one repo instead of the full registry").option("--apply", "PATCH merge settings + activate product ruleset when missing (master role required); activation is skipped while the repo's gate has never passed (#3694)").option("--park-ruleset", "stop the product ruleset enforcing without deleting it \u2014 keeps its required contexts (master role required)").action(async (o) => {
+ci.command("reconcile").description("audit + optionally apply merge settings and product ruleset activation (master-admin)").option("--json", "machine-readable output").option("--repo <owner/repo>", "reconcile one repo instead of the full registry").option("--apply", "PATCH merge settings + activate product ruleset when missing (master role required); activation is skipped while the repo's gate has never passed (#3694)").option("--park-ruleset", "stop the product ruleset enforcing without deleting it ? keeps its required contexts (master role required)").action(async (o) => {
   if (o.apply && o.parkRuleset) {
     return fail("ci reconcile: --apply and --park-ruleset ask for opposite things; pass one");
   }
@@ -32599,7 +33720,7 @@ ci.command("reconcile").description("audit + optionally apply merge settings and
 ${r.repo}: applied=[${r.applied.join("; ")}] skipped=[${r.skipped.join("; ")}]${r.errors.length ? ` errors=[${r.errors.join("; ")}]` : ""}`);
       }
     } else {
-      console.log("\nDry-run \u2014 re-run with --apply to patch merge settings and activate product rulesets (master-admin).");
+      console.log("\nDry-run ? re-run with --apply to patch merge settings and activate product rulesets (master-admin).");
     }
   }
   const applyFailed = applyResults.some((result) => result.errors.length > 0 || result.postApply?.state === "failed");
@@ -32627,7 +33748,7 @@ access.command("role [repo]").description("D14 train authority for a repo (serve
     if (!a.train) process.exitCode = 1;
     return;
   }
-  console.log(`${a.repo}: @${a.login} is ${a.role} \u2014 train ${a.train ? "AUTHORIZED" : "not authorized"}${a.hubTrainMasterOnly ? " (Hub train is master-only)" : ""}`);
+  console.log(`${a.repo}: @${a.login} is ${a.role} ? train ${a.train ? "AUTHORIZED" : "not authorized"}${a.hubTrainMasterOnly ? " (Hub train is master-only)" : ""}`);
   if (!a.train) process.exitCode = 1;
 });
 access.command("audit").description("audit collaborator roles + train-branch push allowlists vs the locked state; read-only, emits gh remediation, never applies").option("--json", "machine-readable output").option("--repo <owner/repo>", "audit a single repo instead of the whole org").option("--class <class>", "repo class for --repo (deployable | content)", "deployable").action(async () => {
@@ -32652,19 +33773,19 @@ access.command("audit").description("audit collaborator roles + train-branch pus
     targets = resolution.targets;
   }
   const derivedMatrix = registryProjects ? accessMatrixFromProjects(registryProjects) : {};
-  const fileMatrix = (0, import_node_fs36.existsSync)("access-matrix.json") ? loadAccessMatrix((0, import_node_fs36.readFileSync)("access-matrix.json", "utf8")) : {};
+  const fileMatrix = (0, import_node_fs39.existsSync)("access-matrix.json") ? loadAccessMatrix((0, import_node_fs39.readFileSync)("access-matrix.json", "utf8")) : {};
   const matrix = mergeAccessMatrix(fileMatrix, derivedMatrix);
   const derivedContracts = registryProjects ? dataAccessContractsFromProjects(registryProjects) : { consumers: {} };
-  const fileContracts = (0, import_node_fs36.existsSync)("data-access-contracts.json") ? loadDataAccessContracts((0, import_node_fs36.readFileSync)("data-access-contracts.json", "utf8")) : { consumers: {} };
+  const fileContracts = (0, import_node_fs39.existsSync)("data-access-contracts.json") ? loadDataAccessContracts((0, import_node_fs39.readFileSync)("data-access-contracts.json", "utf8")) : { consumers: {} };
   const dataAccess = mergeDataAccessContracts(fileContracts, derivedContracts);
-  const sanctioned = (0, import_node_fs36.existsSync)("access-matrix.json") ? loadSanctionedAdmins((0, import_node_fs36.readFileSync)("access-matrix.json", "utf8")) : {};
+  const sanctioned = (0, import_node_fs39.existsSync)("access-matrix.json") ? loadSanctionedAdmins((0, import_node_fs39.readFileSync)("access-matrix.json", "utf8")) : {};
   const report = await auditOrgAccess(targets, deps, matrix, dataAccess, sanctioned);
   console.log(o.json ? JSON.stringify(report, null, 2) : renderAccessReport(report));
   if (!report.ok) process.exitCode = 1;
 });
-access.command("capabilities").description("enumerate your effective vault reach \u2014 every credential NAME + tier + scope you can read/use across project + org/master tiers (names only, no values) (#1615)").option("--repo <owner/repo>", "target repo (defaults to the current repo)").option("--json", "machine-readable output").action((o) => withSecrets((d) => secretsCapabilities(d, o)));
+access.command("capabilities").description("enumerate your effective vault reach ? every credential NAME + tier + scope you can read/use across project + org/master tiers (names only, no values) (#1615)").option("--repo <owner/repo>", "target repo (defaults to the current repo)").option("--json", "machine-readable output").action((o) => withSecrets((d) => secretsCapabilities(d, o)));
 var isWin2 = process.platform === "win32";
-program2.command("doctor").description("heal CLI/plugin wiring and clean up repo cruft \u2014 repairs run by default (#3975); use --verbose for the full audit checklist").option("--banner", "one-line resume summary; silent when all gates pass").option("--fast", "offline-safe fast lane; read-only, skips slow checks and network probes").option("--preflight", "eager version/plugin-heal (env repairs only \u2014 never the repo working tree) with upfront notice when stale; silent when healthy (#1871)").option("--verbose", "print the evidence behind every check \u2014 probes, resolved paths, versions compared, and the names behind each count (#2977)").option("--guide", "print the MMI Agentic Onboarding guide URL").option("--json", "machine-readable output (an output format \u2014 repairs still run by lane)").option("--apply", "deprecated no-op: repairs run by default now (#3975); kept so older instructions still parse").option("--no-repo-writes", "env/plugin repairs only \u2014 never mutate the repo working tree; report pending managed .gitignore repairs with the follow-up command (for train preflights)").option("--self", "verify CLI/plugin version parity and gh auth reach; suggests plugin-heal on a hard gap (reads the published version, so not offline-safe) (#2689)").addHelpText("after", "\nExit codes:\n  0  no hard gaps remain; advisory gaps may exist\n  1  one or more included hard checks failed\n\nA plain run heals env drift (CLI, plugin, marketplace pins) and cleans repo cruft (gitignore block,\nmerged branches, dead worktrees, aged scratch) automatically (#3975). --no-repo-writes keeps the\nworking tree untouched for train preflights; --banner/--fast/--self are read-only lanes.\n\n--banner keeps the legacy SessionStart contract and returns 0 unless the process crashes.\n").action(async (opts) => {
+program2.command("doctor").description("heal CLI/plugin wiring and clean up repo cruft ? repairs run by default (#3975); use --verbose for the full audit checklist").option("--banner", "one-line resume summary; silent when all gates pass").option("--fast", "offline-safe fast lane; read-only, skips slow checks and network probes").option("--preflight", "eager version/plugin-heal (env repairs only ? never the repo working tree) with upfront notice when stale; silent when healthy (#1871)").option("--verbose", "print the evidence behind every check ? probes, resolved paths, versions compared, and the names behind each count (#2977)").option("--guide", "print the MMI Agentic Onboarding guide URL").option("--json", "machine-readable output (an output format ? repairs still run by lane)").option("--apply", "deprecated no-op: repairs run by default now (#3975); kept so older instructions still parse").option("--no-repo-writes", "env/plugin repairs only ? never mutate the repo working tree; report pending managed .gitignore repairs with the follow-up command (for train preflights)").option("--self", "verify CLI/plugin version parity and gh auth reach; suggests plugin-heal on a hard gap (reads the published version, so not offline-safe) (#2689)").addHelpText("after", "\nExit codes:\n  0  no hard gaps remain; advisory gaps may exist\n  1  one or more included hard checks failed\n\nA plain run heals env drift (CLI, plugin, marketplace pins) and cleans repo cruft (gitignore block,\nmerged branches, dead worktrees, aged scratch) automatically (#3975). --no-repo-writes keeps the\nworking tree untouched for train preflights; --banner/--fast/--self are read-only lanes.\n\n--banner keeps the legacy SessionStart contract and returns 0 unless the process crashes.\n").action(async (opts) => {
   if (opts.guide) {
     consoleIo.log("MMI Agentic Onboarding: docs/Architecture/agentic-dev-environment.md");
     return;
@@ -32689,16 +33810,16 @@ function directoryBytes(path2) {
   let total = 0;
   let entries;
   try {
-    entries = (0, import_node_fs36.readdirSync)(path2, { withFileTypes: true });
+    entries = (0, import_node_fs39.readdirSync)(path2, { withFileTypes: true });
   } catch {
     return 0;
   }
   for (const entry of entries) {
-    const child2 = (0, import_node_path35.join)(path2, entry.name);
+    const child2 = (0, import_node_path38.join)(path2, entry.name);
     if (entry.isDirectory()) total += directoryBytes(child2);
     else {
       try {
-        total += (0, import_node_fs36.statSync)(child2).size;
+        total += (0, import_node_fs39.statSync)(child2).size;
       } catch {
       }
     }
@@ -32706,25 +33827,25 @@ function directoryBytes(path2) {
   return total;
 }
 function listDirEntries(dir) {
-  return (0, import_node_fs36.readdirSync)(dir, { withFileTypes: true }).map((d) => ({ name: d.name, isDirectory: d.isDirectory() }));
+  return (0, import_node_fs39.readdirSync)(dir, { withFileTypes: true }).map((d) => ({ name: d.name, isDirectory: d.isDirectory() }));
 }
 function readInstalledPluginRefs(configRoot) {
   const p = installedPluginsPathForConfig(configRoot);
-  if (!(0, import_node_fs36.existsSync)(p)) return [];
+  if (!(0, import_node_fs39.existsSync)(p)) return [];
   try {
-    return installedPluginPaths((0, import_node_fs36.readFileSync)(p, "utf8"));
+    return installedPluginPaths((0, import_node_fs39.readFileSync)(p, "utf8"));
   } catch {
     return null;
   }
 }
 function pluginCacheFsDeps(configRoot, dirBytes) {
   return {
-    exists: (p) => (0, import_node_fs36.existsSync)(p),
-    listVersionDirs: (root) => (0, import_node_fs36.readdirSync)(root, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name),
+    exists: (p) => (0, import_node_fs39.existsSync)(p),
+    listVersionDirs: (root) => (0, import_node_fs39.readdirSync)(root, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name),
     dirBytes,
-    listStagingDirs: (root) => (0, import_node_fs36.readdirSync)(root, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => {
+    listStagingDirs: (root) => (0, import_node_fs39.readdirSync)(root, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => {
       try {
-        return { name: d.name, mtimeMs: newestMtimeMs((0, import_node_path35.join)(root, d.name), listDirEntries, (p) => (0, import_node_fs36.statSync)(p).mtimeMs) };
+        return { name: d.name, mtimeMs: newestMtimeMs((0, import_node_path38.join)(root, d.name), listDirEntries, (p) => (0, import_node_fs39.statSync)(p).mtimeMs) };
       } catch {
         return { name: d.name, mtimeMs: Date.now() };
       }
@@ -32738,10 +33859,10 @@ function stagingApplyFsGuard(configRoot) {
   return {
     referencedPaths: () => readInstalledPluginRefs(configRoot),
     mtimeMs: (name) => {
-      const p = (0, import_node_path35.join)(stagingRoot, name);
-      if (!(0, import_node_fs36.existsSync)(p)) return null;
+      const p = (0, import_node_path38.join)(stagingRoot, name);
+      if (!(0, import_node_fs39.existsSync)(p)) return null;
       try {
-        return newestMtimeMs(p, listDirEntries, (q) => (0, import_node_fs36.statSync)(q).mtimeMs);
+        return newestMtimeMs(p, listDirEntries, (q) => (0, import_node_fs39.statSync)(q).mtimeMs);
       } catch {
         return null;
       }
@@ -32761,13 +33882,13 @@ program2.command("plugin-prune").description(`prune stale cached MMI plugin vers
     return;
   }
   const plan = buildPluginCachePlan(
-    (0, import_node_os14.homedir)(),
+    (0, import_node_os15.homedir)(),
     running,
     pluginCacheFsDeps(configRoot, directoryBytes),
     { withBytes: true, configRoot, includeStaging: surface !== "codex" }
   );
   const anythingToDelete = plan.prune.length > 0 || plan.staging.length > 0;
-  const result = o.apply && anythingToDelete ? applyPluginCachePlan(plan, (p) => (0, import_node_fs36.rmSync)(p, { recursive: true, force: true }), stagingApplyFsGuard(configRoot)) : void 0;
+  const result = o.apply && anythingToDelete ? applyPluginCachePlan(plan, (p) => (0, import_node_fs39.rmSync)(p, { recursive: true, force: true }), stagingApplyFsGuard(configRoot)) : void 0;
   const warnings = plan.prune.length > 0 ? [CONCURRENT_SESSION_WARNING] : [];
   if (o.json) console.log(JSON.stringify({ ...plan, warnings, applied: result ?? null }));
   else console.log(renderPluginCachePlan(plan, result));
@@ -32775,7 +33896,7 @@ program2.command("plugin-prune").description(`prune stale cached MMI plugin vers
 });
 program2.command("session-start").description("run the SessionStart verbs (whoami, board slice, doctor) in one process").action(async () => {
   if (isInsideRepoSubdir(process.cwd())) {
-    console.error("[mmi-hook] plugin session-start: cwd is a repository SUBDIRECTORY \u2014 skipping the SessionStart hook (spine/docs/plan/saga delivery); run it from the repo root.");
+    console.error("[mmi-hook] plugin session-start: cwd is a repository SUBDIRECTORY ? skipping the SessionStart hook (spine/docs/plan/saga delivery); run it from the repo root.");
     appendHookActivity(process.cwd(), { event: "SessionStart", script: "session-start", outcome: "ran", action: "skip (repo subdirectory)" });
     return;
   }
@@ -32788,7 +33909,7 @@ program2.command("session-start").description("run the SessionStart verbs (whoam
   const bannerIo = measured.io;
   const { parallel, sequential } = buildSessionStartPlan({
     // whoami (#879): surface the resolved human so agents act --for them without asking. Silent
-    // when unknown — a missing gh login must not noise or fail the banner.
+    // when unknown ? a missing gh login must not noise or fail the banner.
     whoami: async (io) => {
       const report = await resolveWhoami({
         hubSession: async () => hubAuthSession({ baseUrl: (await loadConfig()).sagaApiUrl ?? defaultHubUrl(), githubToken }),
@@ -32799,15 +33920,15 @@ program2.command("session-start").description("run the SessionStart verbs (whoam
       const authority = authorityLine(report);
       if (authority) io.log(authority);
     },
-    // command-ladder hint (#2609): compact gh→mmi-cli cheat sheet so agents reach for mmi-cli first,
-    // not after a denied gh call. <1KB, pure in-memory — no network, no fs, fail-soft.
+    // command-ladder hint (#2609): compact gh?mmi-cli cheat sheet so agents reach for mmi-cli first,
+    // not after a denied gh call. <1KB, pure in-memory ? no network, no fs, fail-soft.
     commandLadderHint: async (io) => {
       const hint = commandLadderHint();
       if (hint) io.log(hint);
     },
     // stale worktrees: fast LOCAL-only git check (worktree list + branch -vv gone status). Flags leaked
     // worktrees / merged-but-undeleted branches so the session never starts atop leftover state. No
-    // network — never the ~20s `gh pr list` path of `worktree list --stale`. Fail-soft.
+    // network ? never the ~20s `gh pr list` path of `worktree list --stale`. Fail-soft.
     staleWorktrees: async (io) => {
       const line = await gatherStaleWorktreeWarning();
       if (line) io.log(line);
@@ -32820,7 +33941,7 @@ program2.command("session-start").description("run the SessionStart verbs (whoam
       const line = localTrainSyncBannerLine(result);
       if (line) io.log(line);
     },
-    // #3485 item 7: the ONLY lane that throttles the npm read — it runs on every session start, on a
+    // #3485 item 7: the ONLY lane that throttles the npm read ? it runs on every session start, on a
     // blocking hook. Every interactive lane still reads live.
     doctor: async (io) => {
       await runDoctorClean({ banner: true }, io, mmiDoctorDeps({ throttleReleasedRead: true }));
@@ -32830,7 +33951,7 @@ program2.command("session-start").description("run the SessionStart verbs (whoam
   for (const line of scratchGcLines(process.cwd())) bannerIo.log(line);
   const worktreeBanner = worktreeAutoProvisionBanner(process.cwd());
   if (worktreeBanner) {
-    spawnDetachedSelf(["worktree", "setup", "--quiet"], { spawn: import_node_child_process16.spawn, execPath: process.execPath, scriptPath: process.argv[1] });
+    spawnDetachedSelf(["worktree", "setup", "--quiet"], { spawn: import_node_child_process18.spawn, execPath: process.execPath, scriptPath: process.argv[1] });
     bannerIo.log(worktreeBanner);
   }
   if (isLinkedWorktree(process.cwd())) {