@mutmutco/cli 4.1.2 → 4.1.4

package/dist/main.cjs

@@ -151,19 +151,19 @@ function hardExit(code) {
   process.exit(code);
 }
 function flushStream(stream) {
-  return new Promise((resolve5) => {
+  return new Promise((resolve6) => {
     try {
-      stream.write("", () => resolve5());
+      stream.write("", () => resolve6());
     } catch {
-      resolve5();
+      resolve6();
     }
   });
 }
 async function flushStdio(timeoutMs = STDIO_FLUSH_TIMEOUT_MS) {
   await Promise.race([
     Promise.all([flushStream(process.stdout), flushStream(process.stderr)]),
-    new Promise((resolve5) => {
-      setTimeout(resolve5, timeoutMs).unref?.();
+    new Promise((resolve6) => {
+      setTimeout(resolve6, timeoutMs).unref?.();
     })
   ]);
 }
@@ -171,7 +171,7 @@ async function cleanExit(code) {
   process.exitCode = code;
   await closeHttpPool();
   await flushStdio();
-  await new Promise((resolve5) => setImmediate(resolve5));
+  await new Promise((resolve6) => setImmediate(resolve6));
   return void 0;
 }
 async function finishCliRun(watchdogMs = CLI_EXIT_WATCHDOG_MS) {
@@ -476,7 +476,7 @@ function createGitHubClient(options = {}) {
     if (!res.ok) throw await errorFromResponse(res);
     return res;
   }
-  async function parseJson(res) {
+  async function parseJson2(res) {
     if (res.status === 204) return void 0;
     const text = await res.text();
     if (!text) return void 0;
@@ -485,14 +485,14 @@ function createGitHubClient(options = {}) {
   return {
     async rest(method, path2, init) {
       const res = await request(method, joinUrl(baseUrl, path2), init);
-      return parseJson(res);
+      return parseJson2(res);
     },
     async restPaginate(path2, init) {
       const items = [];
       let url = withPerPage(joinUrl(baseUrl, path2));
       while (url) {
         const res = await request("GET", url, init);
-        const page = await parseJson(res);
+        const page = await parseJson2(res);
         if (!Array.isArray(page)) {
           throw new GitHubApiError(
             `pagination page was not a JSON array (got ${page === void 0 ? "an empty body" : typeof page}) \u2014 the list read is PARTIAL and must not be treated as complete: ${url}. Retry the call.`,
@@ -509,7 +509,7 @@ function createGitHubClient(options = {}) {
         ...init,
         body: { query, ...variables ? { variables } : {} }
       });
-      const parsed = await parseJson(res);
+      const parsed = await parseJson2(res);
       if (parsed?.errors?.length) {
         const message = parsed.errors.map((e) => e.message ?? e.type ?? "unknown GraphQL error").join("; ");
         const rateLimited = parsed.errors.some((e) => e.type === "RATE_LIMITED" || /rate limit/i.test(e.message ?? ""));
@@ -572,7 +572,7 @@ async function fetchWithRetry(fetchImpl, url, init, opts = {}) {
   const attempts = opts.attempts ?? 3;
   const baseDelayMs = opts.baseDelayMs ?? 250;
   const retryOn = opts.retryOn ?? ((res) => res.status >= 500);
-  const sleep2 = opts.sleep ?? ((ms) => new Promise((resolve5) => setTimeout(resolve5, ms)));
+  const sleep2 = opts.sleep ?? ((ms) => new Promise((resolve6) => setTimeout(resolve6, ms)));
   let lastErr;
   for (let i = 0; i < attempts; i++) {
     const isLast = i === attempts - 1;
@@ -810,6 +810,8 @@ var init_house_map = __esm({
       // this repo's process-spawn contract
       tests: "core",
       // this repo's test-policy contract
+      dist: "core",
+      // this repo's committed dist/BOM drift receipt (#5576)
       doctor: "core",
       stage: "core",
       plugin: "core",
@@ -859,8 +861,8 @@ async function readStdin(opts = {}) {
   })().catch(() => {
   });
   let timer;
-  const timeout = new Promise((resolve5) => {
-    timer = setTimeout(resolve5, timeoutMs);
+  const timeout = new Promise((resolve6) => {
+    timer = setTimeout(resolve6, timeoutMs);
   });
   try {
     await Promise.race([drain, timeout]);
@@ -899,12 +901,12 @@ function killProcessTree(pid) {
 function execFileHard(file, args, options) {
   const { timeout, step, ...rest } = options;
   const started = Date.now();
-  return new Promise((resolve5, reject) => {
+  return new Promise((resolve6, reject) => {
     const child2 = (0, import_node_child_process3.execFile)(file, args, { encoding: "utf8", windowsHide: true, ...rest, timeout: 0 }, (error, stdout, stderr) => {
       clearTimeout(timer);
       if (expired) return;
       if (error) reject(error);
-      else resolve5({ stdout: String(stdout), stderr: String(stderr) });
+      else resolve6({ stdout: String(stdout), stderr: String(stderr) });
     });
     let expired = false;
     const timer = setTimeout(() => {
@@ -1331,6 +1333,142 @@ var init_plugin_guard = __esm({
   }
 });
 
+// src/kimi-registration.ts
+function validateKimiInstalledPlugin(document, pluginRoot, id) {
+  if (!document || typeof document !== "object" || Array.isArray(document)) return "malformed-document";
+  const plugins = document.plugins;
+  if (!Array.isArray(plugins)) return "malformed-document";
+  const entry = plugins.find(
+    (candidate2) => candidate2 && typeof candidate2 === "object" && !Array.isArray(candidate2) && candidate2.id === id
+  );
+  if (!entry) return "absent-record";
+  const record = entry;
+  if (typeof record.root !== "string") return "malformed-record";
+  if (record.root !== pluginRoot) return "foreign-root";
+  return record.enabled ? "healthy" : "disabled";
+}
+var init_kimi_registration = __esm({
+  "src/kimi-registration.ts"() {
+    "use strict";
+  }
+});
+
+// src/host-doc-lock.ts
+function sharedDocLockPath(documentPath) {
+  return `${documentPath}.jerv-lock`;
+}
+function lockContent(options) {
+  return `${JSON.stringify(options, null, 2)}
+`;
+}
+function readHolder(lockPath) {
+  try {
+    const parsed = JSON.parse((0, import_node_fs18.readFileSync)(lockPath, "utf8"));
+    if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) return null;
+    return parsed;
+  } catch {
+    return null;
+  }
+}
+function lockAgeMs(lockPath, now) {
+  const holder = readHolder(lockPath);
+  const declared = typeof holder?.acquiredAt === "string" ? Date.parse(holder.acquiredAt) : Number.NaN;
+  if (!Number.isNaN(declared)) return Math.max(0, now - declared);
+  try {
+    return Math.max(0, now - (0, import_node_fs18.statSync)(lockPath).mtimeMs);
+  } catch {
+    return 0;
+  }
+}
+function sharedDocLockTimeoutReceipt(documentPath, lockPath, holder, waitedMs) {
+  const named = holder && typeof holder === "object";
+  const who = named ? `held by ${String(holder.owner ?? "unknown")} (pid ${String(holder.pid ?? "?")}, host ${String(holder.host ?? "?")})` : `held by an unreadable lock at ${lockPath}`;
+  return `shared-document lock timeout: ${documentPath} is ${who} \u2014 waited ${waitedMs}ms, nothing was written \u2014 retry next tick or remove ${lockPath} if stale`;
+}
+function acquireSharedDocLock(documentPath, options) {
+  const lockPath = sharedDocLockPath(documentPath);
+  const staleAfterMs = options.staleAfterMs ?? SHARED_DOC_LOCK_STALE_MS;
+  const attempts = options.attempts ?? SHARED_DOC_LOCK_ATTEMPTS;
+  const intervalMs = options.intervalMs ?? SHARED_DOC_LOCK_INTERVAL_MS;
+  const identity = { owner: options.owner, pid: process.pid, host: options.host ?? (0, import_node_os6.hostname)(), acquiredAt: (/* @__PURE__ */ new Date()).toISOString() };
+  const content = lockContent(identity);
+  const sleep2 = (ms) => {
+    Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
+  };
+  for (let attempt = 0; attempt < attempts; attempt += 1) {
+    let fd;
+    try {
+      fd = (0, import_node_fs18.openSync)(lockPath, "wx");
+      (0, import_node_fs18.writeSync)(fd, content);
+      (0, import_node_fs18.closeSync)(fd);
+      return {
+        documentPath,
+        lockPath,
+        owner: identity.owner,
+        pid: identity.pid,
+        host: identity.host,
+        acquiredAt: identity.acquiredAt,
+        release: () => releaseSharedDocLock({ lockPath, owner: identity.owner, pid: identity.pid })
+      };
+    } catch (error) {
+      if (fd !== void 0) {
+        try {
+          (0, import_node_fs18.closeSync)(fd);
+        } catch {
+        }
+        try {
+          (0, import_node_fs18.unlinkSync)(lockPath);
+        } catch {
+        }
+      }
+      if (error?.code !== "EEXIST") throw error;
+    }
+    if (lockAgeMs(lockPath, Date.now()) >= staleAfterMs) {
+      const aside = `${lockPath}.stale-${Date.now()}`;
+      try {
+        (0, import_node_fs18.renameSync)(lockPath, aside);
+      } catch {
+        continue;
+      }
+      try {
+        (0, import_node_fs18.rmSync)(aside, { force: true });
+      } catch {
+      }
+      continue;
+    }
+    if (attempt < attempts - 1) sleep2(intervalMs);
+  }
+  throw new Error(sharedDocLockTimeoutReceipt(documentPath, lockPath, readHolder(lockPath), Math.max(0, attempts * intervalMs)));
+}
+function releaseSharedDocLock(handle) {
+  try {
+    const holder = readHolder(handle.lockPath);
+    if (holder && holder.owner === handle.owner && Number(holder.pid) === handle.pid) {
+      (0, import_node_fs18.unlinkSync)(handle.lockPath);
+    }
+  } catch {
+  }
+}
+function withSharedDocLock(documentPath, options, fn) {
+  const lock = acquireSharedDocLock(documentPath, options);
+  try {
+    return fn(lock.documentPath);
+  } finally {
+    lock.release();
+  }
+}
+var import_node_fs18, import_node_os6, SHARED_DOC_LOCK_STALE_MS, SHARED_DOC_LOCK_ATTEMPTS, SHARED_DOC_LOCK_INTERVAL_MS;
+var init_host_doc_lock = __esm({
+  "src/host-doc-lock.ts"() {
+    "use strict";
+    import_node_fs18 = require("node:fs");
+    import_node_os6 = require("node:os");
+    SHARED_DOC_LOCK_STALE_MS = 3e4;
+    SHARED_DOC_LOCK_ATTEMPTS = 50;
+    SHARED_DOC_LOCK_INTERVAL_MS = 100;
+  }
+});
+
 // src/plugin-guard-io.ts
 var plugin_guard_io_exports = {};
 __export(plugin_guard_io_exports, {
@@ -1364,6 +1502,8 @@ __export(plugin_guard_io_exports, {
   hermesPluginTreeHealthy: () => hermesPluginTreeHealthy,
   installedJervCodePackageVersion: () => installedJervCodePackageVersion,
   kiloConfigListsPlugin: () => kiloConfigListsPlugin,
+  kimiPluginHostEvidence: () => kimiPluginHostEvidence,
+  kimiPluginRegistrationHealth: () => kimiPluginRegistrationHealth,
   kimiPluginTreeHealthy: () => kimiPluginTreeHealthy,
   legacyMmiPiPathEntries: () => legacyMmiPiPathEntries,
   marketplaceAddSupportsRef: () => marketplaceAddSupportsRef,
@@ -1525,12 +1665,12 @@ function surfaceHomeDir(surface) {
   if (surface === "hermes") return ".hermes";
   return ".claude";
 }
-function hermesConfigRoot(env = process.env, home = (0, import_node_os6.homedir)(), platform2 = process.platform) {
+function hermesConfigRoot(env = process.env, home = (0, import_node_os7.homedir)(), platform2 = process.platform) {
   if (env.HERMES_HOME?.trim()) return env.HERMES_HOME.trim();
   if (platform2 === "win32") return (0, import_node_path16.join)(env.LOCALAPPDATA?.trim() || (0, import_node_path16.join)(home, "AppData", "Local"), "hermes");
   return (0, import_node_path16.join)(home, ".hermes");
 }
-function surfaceConfigRoot(surface, env = process.env, home = (0, import_node_os6.homedir)()) {
+function surfaceConfigRoot(surface, env = process.env, home = (0, import_node_os7.homedir)()) {
   if (surface === "codex") return env.CODEX_HOME?.trim() || (0, import_node_path16.join)(home, ".codex");
   if (surface === "kimi") return env.KIMI_CODE_HOME?.trim() || (0, import_node_path16.join)(home, ".kimi-code");
   if (surface === "kilo") return env.KILO_CONFIG_DIR?.trim() || (0, import_node_path16.join)(home, ".config", "kilo");
@@ -1543,7 +1683,7 @@ function surfaceConfigRoot(surface, env = process.env, home = (0, import_node_os
 }
 function readInstalledPlugins(surface = detectSurface(process.env)) {
   try {
-    return JSON.parse((0, import_node_fs18.readFileSync)(installedPluginsPath(surface), "utf8"));
+    return JSON.parse((0, import_node_fs19.readFileSync)(installedPluginsPath(surface), "utf8"));
   } catch {
     return null;
   }
@@ -1562,7 +1702,7 @@ function marketplaceCloneCandidates(surface, home, env = process.env) {
   if (surface === "jervcode") return [];
   return [(0, import_node_path16.join)(home, ".claude", "plugins", "marketplaces", "mutmutco")];
 }
-function marketplaceClonePresent(surface, home, exists = import_node_fs18.existsSync, env = process.env) {
+function marketplaceClonePresent(surface, home, exists = import_node_fs19.existsSync, env = process.env) {
   return marketplaceCloneCandidates(surface, home, env).some(exists);
 }
 function runHostBinSync(bin, args) {
@@ -1597,7 +1737,7 @@ function codexPluginStatus() {
 }
 function countCodexHookCommands(path2) {
   try {
-    const parsed = JSON.parse((0, import_node_fs18.readFileSync)(path2, "utf8"));
+    const parsed = JSON.parse((0, import_node_fs19.readFileSync)(path2, "utf8"));
     let count = 0;
     for (const groups of Object.values(parsed.hooks ?? {})) {
       for (const group of groups) {
@@ -1618,7 +1758,7 @@ function codexHookTrustState(status = codexPluginStatus()) {
   const requiredCount = countCodexHookCommands(hooksPath);
   let config = "";
   try {
-    config = (0, import_node_fs18.readFileSync)((0, import_node_path16.join)(root, "config.toml"), "utf8");
+    config = (0, import_node_fs19.readFileSync)((0, import_node_path16.join)(root, "config.toml"), "utf8");
   } catch {
     return { applicable: true, trusted: false, trustedCount: 0, requiredCount };
   }
@@ -1641,7 +1781,7 @@ async function fetchNpmReleasedVersion() {
     return void 0;
   }
 }
-function kiloConfigListsPlugin(configRoot, home = (0, import_node_os6.homedir)(), read = (p) => (0, import_node_fs18.readFileSync)(p, "utf8"), exists = import_node_fs18.existsSync) {
+function kiloConfigListsPlugin(configRoot, home = (0, import_node_os7.homedir)(), read = (p) => (0, import_node_fs19.readFileSync)(p, "utf8"), exists = import_node_fs19.existsSync) {
   const candidates = ["kilo.json", "kilo.jsonc", "opencode.json", "opencode.jsonc", "config.json"];
   for (const dir of [configRoot, (0, import_node_path16.join)(home, ".kilo")]) {
     for (const file of candidates) {
@@ -1661,10 +1801,10 @@ function kiloConfigListsPlugin(configRoot, home = (0, import_node_os6.homedir)()
   }
   return false;
 }
-function cursorLocalPluginRoot(env = process.env, home = (0, import_node_os6.homedir)()) {
+function cursorLocalPluginRoot(env = process.env, home = (0, import_node_os7.homedir)()) {
   return (0, import_node_path16.join)(surfaceConfigRoot("cursor", env, home), "plugins", "local", "mmi");
 }
-function cursorPluginTreeHealthy(root, exists = import_node_fs18.existsSync) {
+function cursorPluginTreeHealthy(root, exists = import_node_fs19.existsSync) {
   return [
     ".cursor-plugin/plugin.json",
     "skills/mmi/SKILL.md",
@@ -1673,31 +1813,52 @@ function cursorPluginTreeHealthy(root, exists = import_node_fs18.existsSync) {
     "scripts/hook-policy.mjs"
   ].every((path2) => exists((0, import_node_path16.join)(root, ...path2.split("/"))));
 }
-function kimiPluginTreeHealthy(root, exists = import_node_fs18.existsSync) {
+function kimiPluginTreeHealthy(root, exists = import_node_fs19.existsSync) {
   return [
     ".kimi-plugin/plugin.json",
     "skills/mmi/SKILL.md",
     "scripts/hook-run.mjs"
   ].every((path2) => exists((0, import_node_path16.join)(root, ...path2.split("/"))));
 }
-function jervcodeAgentDirs(env = process.env, home = (0, import_node_os6.homedir)()) {
+function kimiPluginRegistrationHealth(kimiHome, pluginRoot, exists = import_node_fs19.existsSync, read = (path2) => (0, import_node_fs19.readFileSync)(path2, "utf8")) {
+  const path2 = (0, import_node_path16.join)(kimiHome, "plugins", "installed.json");
+  if (!exists(path2)) return "absent-record";
+  try {
+    return validateKimiInstalledPlugin(JSON.parse(read(path2)), pluginRoot, "mmi");
+  } catch {
+    return "malformed-document";
+  }
+}
+function kimiPluginHostEvidence(kimiHome) {
+  const root = (0, import_node_path16.join)(kimiHome, "plugins", "managed", "mmi");
+  const treeHealthy = kimiPluginTreeHealthy(root);
+  const registration = kimiPluginRegistrationHealth(kimiHome, root);
+  const healthy = treeHealthy && registration === "healthy";
+  return {
+    treeHealthy,
+    registration,
+    healthy,
+    ...healthy ? {} : treeHealthy ? { receipt: `kimi:registration:${registration}` } : { receipt: "kimi:tree:missing-markers" }
+  };
+}
+function jervcodeAgentDirs(env = process.env, home = (0, import_node_os7.homedir)()) {
   const primary = surfaceConfigRoot("jervcode", env, home);
   const legacy = (0, import_node_path16.join)(home, ".pi", "agent");
   const dirs = [primary];
   if (legacy !== primary) dirs.push(legacy);
-  return dirs.filter((dir) => (0, import_node_fs18.existsSync)(dir));
+  return dirs.filter((dir) => (0, import_node_fs19.existsSync)(dir));
 }
 function readPiSettings(path2) {
-  if (!(0, import_node_fs18.existsSync)(path2)) return void 0;
+  if (!(0, import_node_fs19.existsSync)(path2)) return void 0;
   try {
-    const parsed = JSON.parse((0, import_node_fs18.readFileSync)(path2, "utf8"));
+    const parsed = JSON.parse((0, import_node_fs19.readFileSync)(path2, "utf8"));
     if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return null;
     return parsed;
   } catch {
     return null;
   }
 }
-function mmiPiPackageEntry(env = process.env, home = (0, import_node_os6.homedir)()) {
+function mmiPiPackageEntry(env = process.env, home = (0, import_node_os7.homedir)()) {
   for (const dir of jervcodeAgentDirs(env, home)) {
     const settings = readPiSettings((0, import_node_path16.join)(dir, "settings.json"));
     const entries = Array.isArray(settings?.packages) ? settings.packages : [];
@@ -1708,7 +1869,7 @@ function mmiPiPackageEntry(env = process.env, home = (0, import_node_os6.homedir
   }
   return null;
 }
-function legacyMmiPiPathEntries(env = process.env, home = (0, import_node_os6.homedir)()) {
+function legacyMmiPiPathEntries(env = process.env, home = (0, import_node_os7.homedir)()) {
   const found = [];
   for (const dir of jervcodeAgentDirs(env, home)) {
     const settings = readPiSettings((0, import_node_path16.join)(dir, "settings.json"));
@@ -1719,37 +1880,37 @@ function legacyMmiPiPathEntries(env = process.env, home = (0, import_node_os6.ho
   }
   return found;
 }
-function mmiPiPackageRoot(env = process.env, home = (0, import_node_os6.homedir)()) {
+function mmiPiPackageRoot(env = process.env, home = (0, import_node_os7.homedir)()) {
   for (const dir of jervcodeAgentDirs(env, home)) {
     const root = (0, import_node_path16.join)(dir, "npm", "node_modules", ...JERVCODE_NPM_PACKAGE.split("/"));
-    if ((0, import_node_fs18.existsSync)((0, import_node_path16.join)(root, "package.json"))) return root;
+    if ((0, import_node_fs19.existsSync)((0, import_node_path16.join)(root, "package.json"))) return root;
   }
   return null;
 }
-function installedJervCodePackageVersion(env = process.env, home = (0, import_node_os6.homedir)()) {
+function installedJervCodePackageVersion(env = process.env, home = (0, import_node_os7.homedir)()) {
   const root = mmiPiPackageRoot(env, home);
   if (!root) return void 0;
   try {
-    const manifest = JSON.parse((0, import_node_fs18.readFileSync)((0, import_node_path16.join)(root, "package.json"), "utf8"));
+    const manifest = JSON.parse((0, import_node_fs19.readFileSync)((0, import_node_path16.join)(root, "package.json"), "utf8"));
     return typeof manifest.version === "string" ? manifest.version : void 0;
   } catch {
     return void 0;
   }
 }
-function mmiPiPackageHealthy(env = process.env, home = (0, import_node_os6.homedir)()) {
+function mmiPiPackageHealthy(env = process.env, home = (0, import_node_os7.homedir)()) {
   const root = mmiPiPackageRoot(env, home);
-  return Boolean(root && (0, import_node_fs18.existsSync)((0, import_node_path16.join)(root, "skills", "mmi", "SKILL.md")));
+  return Boolean(root && (0, import_node_fs19.existsSync)((0, import_node_path16.join)(root, "skills", "mmi", "SKILL.md")));
 }
 function piDoctorEnv(agentDir) {
   return { ...process.env, PI_CODING_AGENT_DIR: agentDir };
 }
-function hermesPluginRoot(env = process.env, home = (0, import_node_os6.homedir)()) {
+function hermesPluginRoot(env = process.env, home = (0, import_node_os7.homedir)()) {
   return (0, import_node_path16.join)(hermesConfigRoot(env, home), "plugins", "mmi");
 }
-function hermesPluginTreeHealthy(root, exists = import_node_fs18.existsSync) {
+function hermesPluginTreeHealthy(root, exists = import_node_fs19.existsSync) {
   if (!["plugin.yaml", "__init__.py"].every((file) => exists((0, import_node_path16.join)(root, file)))) return false;
   try {
-    return (0, import_node_fs18.statSync)((0, import_node_path16.join)(root, "skills")).isDirectory();
+    return (0, import_node_fs19.statSync)((0, import_node_path16.join)(root, "skills")).isDirectory();
   } catch {
     return false;
   }
@@ -1758,22 +1919,23 @@ function snapshotPluginGuardInput(surface = detectSurface(process.env), isOrgRep
   const root = surfaceConfigRoot(surface);
   const installed = readInstalledPlugins(surface);
   const codexStatus = surface === "codex" ? codexPluginStatus() : void 0;
+  const kimi = surface === "kimi" ? kimiPluginHostEvidence(root) : void 0;
   const piEntry = surface === "jervcode" ? mmiPiPackageEntry() : null;
   return {
     isOrgRepo,
-    installRecordPresent: hasUserInstallRecord(installed, MMI_PLUGIN_ID) || hasProjectInstallRecord(installed, MMI_PLUGIN_ID, process.cwd()) || // Kimi's managed plugin directory is its native install record; it has no Claude-style ledger.
-    surface === "kimi" && (0, import_node_fs18.existsSync)((0, import_node_path16.join)(root, "plugins", "managed", "mmi")) || // kilo-p1: the install record is the config file itself.
+    installRecordPresent: hasUserInstallRecord(installed, MMI_PLUGIN_ID) || hasProjectInstallRecord(installed, MMI_PLUGIN_ID, process.cwd()) || // Kimi loads only records in plugins/installed.json; a managed tree alone is inert.
+    surface === "kimi" && kimi?.registration === "healthy" || // kilo-p1: the install record is the config file itself.
     surface === "kilo" && kiloConfigListsPlugin(root) || // #4188: jervcode's install record is the settings-file packages[] entry itself.
-    surface === "jervcode" && piEntry !== null || surface === "cursor" && (0, import_node_fs18.existsSync)(cursorLocalPluginRoot()) || surface === "hermes" && (0, import_node_fs18.existsSync)(hermesPluginRoot()),
+    surface === "jervcode" && piEntry !== null || surface === "cursor" && (0, import_node_fs19.existsSync)(cursorLocalPluginRoot()) || surface === "hermes" && (0, import_node_fs19.existsSync)(hermesPluginRoot()),
     // Kilo has no marketplace to clone — the config file IS the install record, so this dimension of
     // the shared guard table is vacuously satisfied. Same for jervcode's settings entry.
-    marketplaceClonePresent: surface === "kimi" || surface === "kilo" || surface === "cursor" || surface === "jervcode" || surface === "hermes" ? true : marketplaceClonePresent(surface, (0, import_node_os6.homedir)()),
+    marketplaceClonePresent: surface === "kimi" || surface === "kilo" || surface === "cursor" || surface === "jervcode" || surface === "hermes" ? true : marketplaceClonePresent(surface, (0, import_node_os7.homedir)()),
     // Kimi keeps no plugin cache dir — installs are copied to plugins/managed/<id> and run from there.
     // Kilo (kilo-p1) keeps no cache dir either: the plugin's server() provisions ~/.kilo behind the
     // version stamp, so the stamp's presence is the cache signal.
-    pluginCachePresent: surface === "jervcode" ? mmiPiPackageHealthy() : surface === "hermes" ? hermesPluginTreeHealthy(hermesPluginRoot()) : surface === "kilo" ? (0, import_node_fs18.existsSync)((0, import_node_path16.join)((0, import_node_os6.homedir)(), ".kilo", ".mmi-kilo-version")) : surface === "kimi" ? kimiPluginTreeHealthy((0, import_node_path16.join)(root, "plugins", "managed", "mmi")) : surface === "cursor" ? cursorPluginTreeHealthy(cursorLocalPluginRoot()) : surface === "codex" ? Boolean(
-      codexStatus?.installed && codexStatus.enabled && codexStatus.version && (0, import_node_fs18.existsSync)((0, import_node_path16.join)(root, "plugins", "cache", CODEX_MARKETPLACE, "mmi", codexStatus.version))
-    ) : (0, import_node_fs18.existsSync)((0, import_node_path16.join)(root, "plugins", "cache", "mutmutco", "mmi"))
+    pluginCachePresent: surface === "jervcode" ? mmiPiPackageHealthy() : surface === "hermes" ? hermesPluginTreeHealthy(hermesPluginRoot()) : surface === "kilo" ? (0, import_node_fs19.existsSync)((0, import_node_path16.join)((0, import_node_os7.homedir)(), ".kilo", ".mmi-kilo-version")) : surface === "kimi" ? Boolean(kimi?.healthy) : surface === "cursor" ? cursorPluginTreeHealthy(cursorLocalPluginRoot()) : surface === "codex" ? Boolean(
+      codexStatus?.installed && codexStatus.enabled && codexStatus.version && (0, import_node_fs19.existsSync)((0, import_node_path16.join)(root, "plugins", "cache", CODEX_MARKETPLACE, "mmi", codexStatus.version))
+    ) : (0, import_node_fs19.existsSync)((0, import_node_path16.join)(root, "plugins", "cache", "mutmutco", "mmi"))
   };
 }
 function claudePluginGuardState(isOrgRepo) {
@@ -1800,7 +1962,7 @@ function captureCodexHookLauncher() {
   const files = ["mmi-hook", "mmi-hook.exe"].flatMap((name) => {
     const path2 = (0, import_node_path16.join)(root, "bin", name);
     try {
-      return [{ name, content: (0, import_node_fs18.readFileSync)(path2) }];
+      return [{ name, content: (0, import_node_fs19.readFileSync)(path2) }];
     } catch {
       return [];
     }
@@ -1808,13 +1970,13 @@ function captureCodexHookLauncher() {
   return files.length === 2 ? { root, files } : void 0;
 }
 function restoreCodexHookLauncher(snapshot) {
-  if (!snapshot || (0, import_node_fs18.existsSync)((0, import_node_path16.join)(snapshot.root, "scripts", "hook-run.mjs"))) return false;
+  if (!snapshot || (0, import_node_fs19.existsSync)((0, import_node_path16.join)(snapshot.root, "scripts", "hook-run.mjs"))) return false;
   const bin = (0, import_node_path16.join)(snapshot.root, "bin");
-  (0, import_node_fs18.mkdirSync)(bin, { recursive: true });
+  (0, import_node_fs19.mkdirSync)(bin, { recursive: true });
   for (const file of snapshot.files) {
     const path2 = (0, import_node_path16.join)(bin, file.name);
-    (0, import_node_fs18.writeFileSync)(path2, file.content);
-    if (file.name === "mmi-hook") (0, import_node_fs18.chmodSync)(path2, 493);
+    (0, import_node_fs19.writeFileSync)(path2, file.content);
+    if (file.name === "mmi-hook") (0, import_node_fs19.chmodSync)(path2, 493);
   }
   return true;
 }
@@ -1823,13 +1985,13 @@ function canonicalCursorRemote(remote) {
 }
 function readJsonFile(path2) {
   try {
-    return JSON.parse((0, import_node_fs18.readFileSync)(path2, "utf8"));
+    return JSON.parse((0, import_node_fs19.readFileSync)(path2, "utf8"));
   } catch {
     return null;
   }
 }
 async function cursorTreeManaged(target) {
-  if ((0, import_node_fs18.existsSync)((0, import_node_path16.join)(target, ".git"))) {
+  if ((0, import_node_fs19.existsSync)((0, import_node_path16.join)(target, ".git"))) {
     try {
       const { stdout } = await runHostBin("git", ["-C", target, "remote", "get-url", "origin"], { timeout: 15e3 });
       if (canonicalCursorRemote(stdout)) return { ok: true };
@@ -1850,19 +2012,19 @@ async function installCursorPluginCheckout(env = process.env) {
   const pluginsRoot = (0, import_node_path16.join)(configRoot, "plugins");
   const target = (0, import_node_path16.join)(pluginsRoot, "local", "mmi");
   const source = env.MMI_CURSOR_PLUGIN_SOURCE?.trim();
-  if ((0, import_node_fs18.existsSync)(target) && !source) {
+  if ((0, import_node_fs19.existsSync)(target) && !source) {
     const managed = await cursorTreeManaged(target);
     if (!managed.ok) return { ok: false, detail: managed.detail };
   }
-  (0, import_node_fs18.mkdirSync)((0, import_node_path16.join)(pluginsRoot, "local"), { recursive: true });
-  (0, import_node_fs18.mkdirSync)((0, import_node_path16.join)(pluginsRoot, "staging"), { recursive: true });
-  (0, import_node_fs18.mkdirSync)((0, import_node_path16.join)(pluginsRoot, "quarantine"), { recursive: true });
+  (0, import_node_fs19.mkdirSync)((0, import_node_path16.join)(pluginsRoot, "local"), { recursive: true });
+  (0, import_node_fs19.mkdirSync)((0, import_node_path16.join)(pluginsRoot, "staging"), { recursive: true });
+  (0, import_node_fs19.mkdirSync)((0, import_node_path16.join)(pluginsRoot, "quarantine"), { recursive: true });
   const suffix = `${Date.now()}-${process.pid}`;
   const staged = (0, import_node_path16.join)(pluginsRoot, "staging", `mmi-${suffix}`);
   const quarantined = (0, import_node_path16.join)(pluginsRoot, "quarantine", `mmi-${suffix}`);
   try {
     if (source) {
-      (0, import_node_fs18.cpSync)(source, staged, {
+      (0, import_node_fs19.cpSync)(source, staged, {
         recursive: true,
         filter: (path2) => !path2.split(/[\\/]/).some((part) => part === ".git" || part === "node_modules")
       });
@@ -1873,18 +2035,18 @@ async function installCursorPluginCheckout(env = process.env) {
       });
     }
     if (!cursorPluginTreeHealthy(staged)) {
-      (0, import_node_fs18.rmSync)(staged, { recursive: true, force: true });
+      (0, import_node_fs19.rmSync)(staged, { recursive: true, force: true });
       return { ok: false, detail: "downloaded Cursor plugin is incomplete; existing install was preserved" };
     }
     let movedOld = false;
-    if ((0, import_node_fs18.existsSync)(target)) {
-      (0, import_node_fs18.renameSync)(target, quarantined);
+    if ((0, import_node_fs19.existsSync)(target)) {
+      (0, import_node_fs19.renameSync)(target, quarantined);
       movedOld = true;
     }
     try {
-      (0, import_node_fs18.renameSync)(staged, target);
+      (0, import_node_fs19.renameSync)(staged, target);
     } catch (error) {
-      if (movedOld && !(0, import_node_fs18.existsSync)(target)) (0, import_node_fs18.renameSync)(quarantined, target);
+      if (movedOld && !(0, import_node_fs19.existsSync)(target)) (0, import_node_fs19.renameSync)(quarantined, target);
       throw error;
     }
     return {
@@ -1892,7 +2054,7 @@ async function installCursorPluginCheckout(env = process.env) {
       detail: movedOld ? `installed canonical Cursor plugin; previous checkout quarantined at ${quarantined}` : `installed canonical Cursor plugin at ${target}`
     };
   } catch (error) {
-    if ((0, import_node_fs18.existsSync)(staged)) (0, import_node_fs18.rmSync)(staged, { recursive: true, force: true });
+    if ((0, import_node_fs19.existsSync)(staged)) (0, import_node_fs19.rmSync)(staged, { recursive: true, force: true });
     return { ok: false, detail: error.message.trim().slice(0, 240).replace(/\s+/g, " ") };
   }
 }
@@ -1929,7 +2091,7 @@ async function runHealSteps(host, tableSteps, deps) {
   const refSupported = needsRefProbe ? await marketplaceAddRefSupported(host) : true;
   const { steps } = adaptHealStepsForRefSupport(tableSteps, refSupported);
   if (deps.banner) log(deps.banner(refSupported));
-  const pinsPath = (0, import_node_path16.join)((0, import_node_os6.homedir)(), ...KNOWN_MARKETPLACES_RELATIVE);
+  const pinsPath = (0, import_node_path16.join)((0, import_node_os7.homedir)(), ...KNOWN_MARKETPLACES_RELATIVE);
   const pins = host === "claude" ? captureMarketplacePins(readKnownMarketplacesFile(pinsPath), [MMI_MARKETPLACE_NAME, JERV_MARKETPLACE_NAME]) : /* @__PURE__ */ new Map();
   let failure;
   try {
@@ -2052,7 +2214,7 @@ async function healActivePluginForDoctor(surface = detectSurface(process.env), o
 }
 function readKnownMarketplacesFile(path2) {
   try {
-    return (0, import_node_fs18.existsSync)(path2) ? (0, import_node_fs18.readFileSync)(path2, "utf8") : void 0;
+    return (0, import_node_fs19.existsSync)(path2) ? (0, import_node_fs19.readFileSync)(path2, "utf8") : void 0;
   } catch {
     return void 0;
   }
@@ -2074,24 +2236,37 @@ function claudeCodeIsRunning(env = process.env, listProcesses = defaultProcessLi
 function defaultProcessList() {
   return isWin ? (0, import_node_child_process8.execFileSync)("powershell.exe", ["-NoProfile", "-Command", "Get-CimInstance Win32_Process | ForEach-Object { $_.CommandLine }"], { encoding: "utf8", windowsHide: true, maxBuffer: 32 * 1024 * 1024, timeout: 15e3 }) : (0, import_node_child_process8.execFileSync)("ps", ["-eo", "args="], { encoding: "utf8", windowsHide: true, timeout: 15e3 });
 }
-function writeMarketplacePinsOnDisk(path2, pins, succeeded, failedVerb, declineWhileHostLive) {
+function writeMarketplacePinsOnDisk(path2, pins, succeeded, failedVerb, declineWhileHostLive, lock = {}) {
   if (pins.size === 0) return void 0;
-  const after = readKnownMarketplacesFile(path2);
-  const next = restoreMarketplacePins(after, pins);
-  if (next === null) return void 0;
-  const declined = declineWhileHostLive?.();
-  if (declined) return declined;
   try {
-    (0, import_node_fs18.writeFileSync)(path2, next, "utf8");
-  } catch {
-    return `could NOT ${failedVerb} ${[...pins.keys()].join(", ")} \u2014 set it by hand`;
+    return withSharedDocLock(path2, { owner: MARKETPLACE_PINS_LOCK_OWNER, ...lock }, () => {
+      const after = readKnownMarketplacesFile(path2);
+      const next = restoreMarketplacePins(after, pins);
+      if (next === null) return void 0;
+      const declined = declineWhileHostLive?.();
+      if (declined) return declined;
+      const tmp = `${path2}.tmp-${process.pid}`;
+      try {
+        (0, import_node_fs19.writeFileSync)(tmp, next, "utf8");
+        (0, import_node_fs19.renameSync)(tmp, path2);
+      } catch {
+        try {
+          (0, import_node_fs19.rmSync)(tmp, { force: true });
+        } catch {
+        }
+        return `could NOT ${failedVerb} ${[...pins.keys()].join(", ")} \u2014 set it by hand`;
+      }
+      const verify = readKnownMarketplacesFile(path2);
+      const failed = [...pins].filter(([name, want]) => {
+        const got = readKnownMarketplace(verify, name);
+        return typeof want.autoUpdate === "boolean" && got.declared !== want.autoUpdate || want.ref !== void 0 && got.ref !== want.ref;
+      });
+      return failed.length ? `${failedVerb} did NOT take for ${failed.map(([n]) => n).join(", ")} \u2014 set it by hand` : succeeded(pins);
+    });
+  } catch (error) {
+    if (error instanceof Error && error.message.startsWith("shared-document lock timeout:")) return error.message;
+    throw error;
   }
-  const verify = readKnownMarketplacesFile(path2);
-  const failed = [...pins].filter(([name, want]) => {
-    const got = readKnownMarketplace(verify, name);
-    return typeof want.autoUpdate === "boolean" && got.declared !== want.autoUpdate || want.ref !== void 0 && got.ref !== want.ref;
-  });
-  return failed.length ? `${failedVerb} did NOT take for ${failed.map(([n]) => n).join(", ")} \u2014 set it by hand` : succeeded(pins);
 }
 function restoreMarketplacePinsOnDisk(path2, pins, hostIsRunning = claudeCodeIsRunning) {
   return writeMarketplacePinsOnDisk(
@@ -2101,7 +2276,7 @@ function restoreMarketplacePinsOnDisk(path2, pins, hostIsRunning = claudeCodeIsR
     "restore"
   );
 }
-function applyOrgMarketplacePins(path2, names, hostIsRunning = claudeCodeIsRunning) {
+function applyOrgMarketplacePins(path2, names, hostIsRunning = claudeCodeIsRunning, lock = {}) {
   let landed = false;
   let blockedByHost = false;
   const detail = writeMarketplacePinsOnDisk(
@@ -2116,21 +2291,22 @@ function applyOrgMarketplacePins(path2, names, hostIsRunning = claudeCodeIsRunni
       if (!hostIsRunning()) return void 0;
       blockedByHost = true;
       return "not pinned \u2014 Claude Code is running and rewrites this registration from its own copy; quit it, then run `mmi-cli doctor`";
-    }
+    },
+    lock
   );
   return detail === void 0 ? void 0 : { detail, wrote: landed, blockedByHost };
 }
 function writeMarketplacePinPending(path2, names, now = Date.now()) {
   try {
-    (0, import_node_fs18.mkdirSync)((0, import_node_path16.dirname)(path2), { recursive: true });
-    (0, import_node_fs18.writeFileSync)(path2, `${JSON.stringify({ v: 1, names: [...names], at: new Date(now).toISOString() })}
+    (0, import_node_fs19.mkdirSync)((0, import_node_path16.dirname)(path2), { recursive: true });
+    (0, import_node_fs19.writeFileSync)(path2, `${JSON.stringify({ v: 1, names: [...names], at: new Date(now).toISOString() })}
 `, "utf8");
   } catch {
   }
 }
 function readMarketplacePinPending(path2, name, now = Date.now()) {
   try {
-    const parsed = JSON.parse((0, import_node_fs18.readFileSync)(path2, "utf8"));
+    const parsed = JSON.parse((0, import_node_fs19.readFileSync)(path2, "utf8"));
     const at = typeof parsed.at === "string" ? Date.parse(parsed.at) : Number.NaN;
     if (parsed.v !== 1 || !Array.isArray(parsed.names) || !parsed.names.includes(name) || !Number.isFinite(at)) return void 0;
     if (now - at < 0 || now - at > 12 * 60 * 6e4) return void 0;
@@ -2218,18 +2394,20 @@ async function runPluginHeal(surface = detectSurface(process.env)) {
   ${recovery}${note}${pluginReadGrantNote()}`);
   }
 }
-var import_node_fs18, import_node_child_process8, import_node_path16, import_node_os6, isWin, MMI_PLUGIN_ID, LEGACY_MMI_MARKETPLACE, CODEX_MARKETPLACE, CLAUDE_RECOVERY, CODEX_RECOVERY, CURSOR_RECOVERY, PLUGIN_SURFACE_HEAL, CLAUDE_PLUGIN_TIMEOUT_MS, NPM_VIEW_TIMEOUT_MS, installedPluginsPath, JERVCODE_NPM_PACKAGE, LEGACY_MMI_PI_PATH, PLUGIN_READ_REPO2;
+var import_node_fs19, import_node_child_process8, import_node_path16, import_node_os7, isWin, MMI_PLUGIN_ID, LEGACY_MMI_MARKETPLACE, CODEX_MARKETPLACE, CLAUDE_RECOVERY, CODEX_RECOVERY, CURSOR_RECOVERY, PLUGIN_SURFACE_HEAL, CLAUDE_PLUGIN_TIMEOUT_MS, NPM_VIEW_TIMEOUT_MS, installedPluginsPath, JERVCODE_NPM_PACKAGE, LEGACY_MMI_PI_PATH, PLUGIN_READ_REPO2, MARKETPLACE_PINS_LOCK_OWNER;
 var init_plugin_guard_io = __esm({
   "src/plugin-guard-io.ts"() {
     "use strict";
-    import_node_fs18 = require("node:fs");
+    import_node_fs19 = require("node:fs");
     import_node_child_process8 = require("node:child_process");
     import_node_path16 = require("node:path");
-    import_node_os6 = require("node:os");
+    import_node_os7 = require("node:os");
     init_marketplace_autoupdate();
     init_cli_shared();
     init_version_lag();
     init_plugin_guard();
+    init_kimi_registration();
+    init_host_doc_lock();
     isWin = process.platform === "win32";
     MMI_PLUGIN_ID = "mmi@mutmutco";
     LEGACY_MMI_MARKETPLACE = "mmi";
@@ -2290,6 +2468,7 @@ var init_plugin_guard_io = __esm({
     JERVCODE_NPM_PACKAGE = "@mutmutco/pi-plugin";
     LEGACY_MMI_PI_PATH = /[/\\]mutmutco[/\\]mmi[/\\]\d+\.\d+\.\d+[/\\]\.pi-plugin[/\\]?$/i;
     PLUGIN_READ_REPO2 = "mutmutco/MMI-Hub";
+    MARKETPLACE_PINS_LOCK_OWNER = "mmi-hub:marketplace-pins";
   }
 });
 
@@ -5681,8 +5860,8 @@ var program = new Command();
 
 // src/index.ts
 var import_promises8 = require("node:fs/promises");
-var import_node_fs43 = require("node:fs");
-var import_node_child_process20 = require("node:child_process");
+var import_node_fs46 = require("node:fs");
+var import_node_child_process21 = require("node:child_process");
 init_cli_shared();
 
 // src/issue-surface.ts
@@ -6723,7 +6902,7 @@ function commandLadderHint() {
 }
 
 // src/index.ts
-var import_node_path40 = require("node:path");
+var import_node_path42 = require("node:path");
 
 // src/merge-ci-policy.ts
 function resolveMergeCiPolicy(input) {
@@ -6843,6 +7022,32 @@ function conflictingResult(policy, baseBranch, waitedMs) {
   return { policy, status: "conflicting", reason: conflictingPrMessage(baseBranch), detail: "conflicting", waitedMs };
 }
 var PR_CHECKS_TIMEOUT_EXIT_CODE = 2;
+function isRetryableGitHubWaitReadError(e) {
+  const status = typeof e?.status === "number" ? e.status : void 0;
+  const code = typeof e?.code === "string" ? e.code : "";
+  const text = [
+    typeof e?.stderr === "string" ? e.stderr : "",
+    typeof e?.stdout === "string" ? e.stdout : "",
+    e instanceof Error ? e.message : String(e ?? "")
+  ].join("\n");
+  const codes = /* @__PURE__ */ new Set();
+  if (typeof status === "number" && status > 0) codes.add(status);
+  for (const m of text.matchAll(/\bHTTP\/?\d*(?:\.\d)?\s+(\d{3})\b/g)) codes.add(Number(m[1]));
+  const rateLimited = e?.rateLimited === true || /API rate limit already exceeded|rate limit already exceeded|RATE_LIMITED|secondary rate|abuse detection/i.test(text);
+  if ([401, 404, 409, 422].some((c) => codes.has(c))) return false;
+  if (codes.has(403) && !rateLimited) return false;
+  if (codes.has(429) || rateLimited) return true;
+  if ([...codes].some((c) => c >= 500 && c < 600)) return true;
+  if (/^(ETIMEDOUT|ECONNRESET|ECONNREFUSED|ENOTFOUND|EAI_AGAIN|ENETUNREACH)$/i.test(code) || /ETIMEDOUT|ECONNRESET|ECONNREFUSED|ENOTFOUND|EAI_AGAIN|socket hang up|network timeout|Client network socket disconnected/i.test(text)) {
+    return true;
+  }
+  return /Something went wrong while executing your query/.test(text) || /^\s*unexpected end of JSON input\s*$/m.test(text);
+}
+function waitReadFailureMessage(e) {
+  const err = e;
+  const stderr = typeof err?.stderr === "string" ? err.stderr.trim() : "";
+  return (stderr || err?.message || String(e)).replace(/\s+/g, " ").slice(0, 300);
+}
 var PR_CHECKS_POLL_MS = 3e4;
 var PR_CHECKS_TIMEOUT_MS = 30 * 6e4;
 var PR_CHECKS_SUCCESS_CONFIRMATIONS = 2;
@@ -6877,14 +7082,22 @@ async function waitForPrChecks(deps) {
   const baseBranch = deps.baseBranch ?? "development";
   const queuedStates = [];
   if (policy === "no-ci") {
-    const firstState = await deps.pollChecks();
-    if (firstState === "no-checks-reported") {
-      return { policy, status: "skipped", reason };
+    try {
+      const firstState = await deps.pollChecks();
+      if (firstState === "no-checks-reported") {
+        return { policy, status: "skipped", reason };
+      }
+      reason = NO_CI_LIVE_CHECKS_CONTRADICTION_REASON;
+      deps.log?.(`merge CI policy contradiction: ${reason}; waiting for live PR checks`);
+      policy = "wait-for-checks";
+      queuedStates.push(firstState);
+    } catch (e) {
+      if (!isRetryableGitHubWaitReadError(e)) {
+        return { policy, status: "failure", reason: waitReadFailureMessage(e), detail: "github-read-failed" };
+      }
+      deps.log?.(`merge CI policy no-ci probe hit a transient GitHub read failure \u2014 waiting: ${waitReadFailureMessage(e)}`);
+      policy = "wait-for-checks";
     }
-    reason = NO_CI_LIVE_CHECKS_CONTRADICTION_REASON;
-    deps.log?.(`merge CI policy contradiction: ${reason}; waiting for live PR checks`);
-    policy = "wait-for-checks";
-    queuedStates.push(firstState);
   }
   if (deps.pollMergeable) {
     const mergeable = await resolveSettledMergeableState(deps.pollMergeable, deps.sleep);
@@ -6934,7 +7147,19 @@ async function waitForPrChecks(deps) {
       const mergeable = await deps.pollMergeable();
       if (mergeable === "CONFLICTING") return conflictingResult(policy, baseBranch, now() - started);
     }
-    const state = queuedStates.shift() ?? await deps.pollChecks();
+    let state;
+    try {
+      state = queuedStates.shift() ?? await deps.pollChecks();
+    } catch (e) {
+      if (!isRetryableGitHubWaitReadError(e)) {
+        return { policy, status: "failure", reason: waitReadFailureMessage(e), detail: "github-read-failed", waitedMs: now() - started };
+      }
+      lastDetail = `github-read-transient (${waitReadFailureMessage(e)})`;
+      deps.log?.(`transient GitHub read failure \u2014 retrying within the wait budget: ${lastDetail}`);
+      report("pending");
+      await deps.sleep(PR_CHECKS_POLL_MS);
+      continue;
+    }
     report(state);
     if (state !== "success") successStreak = 0;
     if (state !== "failure") failureStreak = 0;
@@ -8449,15 +8674,9 @@ function gateSeedVars(cls, releaseTrack, runtime = "node", requiredCheckBranches
   const trackBranches = track === "trunk" ? ["main"] : track === "direct" ? ["development", "main"] : ["development", "rc", "main"];
   const rulesetBranches = requiredCheckBranches?.length ? [...requiredCheckBranches] : trackBranches;
   const rulesetRefs = JSON.stringify(rulesetBranches.map((branch) => `refs/heads/${branch}`));
-  const windowsCompat = {
-    // #5113: opt-in informational windows-latest proof. Default OFF — the CLI fills the rendered job
-    // YAML (or '') at the final layering step; never hand-passed.
-    GATE_WINDOWS_COMPAT_JOB_YAML: ""
-  };
   if (track === "trunk") {
     return {
       ...runtimeVars,
-      ...windowsCompat,
       GATE_PUSH_BRANCHES_YAML: "[main]",
       GATE_FULL_RUN_BRANCH: "main",
       GATE_RULESET_BRANCH_REFS_JSON: rulesetRefs
@@ -8466,7 +8685,6 @@ function gateSeedVars(cls, releaseTrack, runtime = "node", requiredCheckBranches
   if (track === "direct") {
     return {
       ...runtimeVars,
-      ...windowsCompat,
       GATE_PUSH_BRANCHES_YAML: "[development, main]",
       GATE_FULL_RUN_BRANCH: "development",
       GATE_RULESET_BRANCH_REFS_JSON: rulesetRefs
@@ -8474,7 +8692,6 @@ function gateSeedVars(cls, releaseTrack, runtime = "node", requiredCheckBranches
   }
   return {
     ...runtimeVars,
-    ...windowsCompat,
     GATE_PUSH_BRANCHES_YAML: "[development, rc, main]",
     GATE_FULL_RUN_BRANCH: "development",
     GATE_RULESET_BRANCH_REFS_JSON: rulesetRefs
@@ -8491,38 +8708,8 @@ function withDerivedRepoVars(vars, parsed, cls, releaseTrack, requiredCheckBranc
   for (const [key, value] of Object.entries(gateSeedVars(cls, track, runtime, requiredCheckBranches))) {
     out[key] ??= value;
   }
-  if (out.GATE_WINDOWS_COMPAT === "true" && !out.GATE_WINDOWS_COMPAT_JOB_YAML) {
-    out.GATE_WINDOWS_COMPAT_JOB_YAML = windowsCompatJobYaml(out);
-  }
   return out;
 }
-function windowsCompatJobYaml(vars) {
-  const workdir = vars.GATE_WORKDIR ?? ".";
-  const cmd = vars.GATE_CMD ?? DEFAULT_GATE_CMD;
-  const install = vars.GATE_INSTALL_CMD ?? "npm ci";
-  const fullRunBranch = vars.GATE_FULL_RUN_BRANCH ?? "development";
-  const runtime = vars.GATE_RUNTIME === "python" ? "python" : "node";
-  const setup = runtime === "python" ? `      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
-        with: { python-version: '${vars.GATE_PY_VERSION ?? DEFAULT_GATE_PY_VERSION}' }` : `      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
-        with: { node-version: 24, cache: npm, cache-dependency-path: ${vars.GATE_CACHE_DEP_PATH ?? "package-lock.json"} }`;
-  return `  # MMI-Hub#5113: opt-in Windows compatibility proof \u2014 informational only. Do NOT add this job to a
-  # required-contexts ruleset without a deliberate repo decision: the required gate stays the Linux lane
-  # (faster, cheaper, where autonomous agents run). GitHub-hosted Windows minutes cost more than Linux,
-  # hence opt-in. defaults.run.shell=bash is Git for Windows bash on windows-latest, so the check syntax
-  # the Linux gate runs keeps working here.
-  windows-compat:
-    if: \${{ github.event_name == 'pull_request' || (github.event_name == 'push' && (github.ref_name == '${fullRunBranch}' || github.ref_name == 'main')) }}
-    runs-on: windows-latest
-    defaults:
-      run: { working-directory: ${workdir}, shell: bash }
-    steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
-${setup}
-      - run: ${install}
-      # Fast proof only \u2014 the full suite stays on the Linux gate.
-      - run: ${cmd}
-`;
-}
 function gateConfigToVars(gate) {
   const out = {};
   if (!gate || typeof gate !== "object") return out;
@@ -8533,7 +8720,6 @@ function gateConfigToVars(gate) {
   if (typeof gate.pyVersion === "string" && gate.pyVersion.trim()) out.GATE_PY_VERSION = gate.pyVersion;
   const seconds = typeof gate.maxSeconds === "number" ? String(gate.maxSeconds) : gate.maxSeconds;
   if (typeof seconds === "string" && /^\d+$/.test(seconds.trim()) && Number(seconds) > 0) out.GATE_MAX_SECONDS = seconds.trim();
-  if (gate.windowsCompat === true) out.GATE_WINDOWS_COMPAT = "true";
   return out;
 }
 function seedMatchesDeployModel(seed, deployModel) {
@@ -10396,7 +10582,7 @@ function rateLimitedReceipt(opts) {
   };
 }
 async function runWithRateLimitBackoff(operation, opts) {
-  const sleep2 = opts.sleep ?? ((ms) => new Promise((resolve5) => setTimeout(resolve5, ms)));
+  const sleep2 = opts.sleep ?? ((ms) => new Promise((resolve6) => setTimeout(resolve6, ms)));
   const now = opts.now ?? Date.now;
   const log = opts.log ?? ((message) => console.warn(message));
   const capMs = opts.capMs ?? RATE_LIMIT_WAIT_CAP_MS;
@@ -10650,6 +10836,69 @@ function flagValue(args, flag) {
   if (i === -1 || i + 1 >= args.length) return void 0;
   return args[i + 1];
 }
+function isPrCreateRemoteHeadGraphqlNoise(text) {
+  return /Head sha can't be blank/i.test(text) || /Head ref must be a branch/i.test(text) || /No commits between /i.test(text);
+}
+function unpushedHeadMessage(head) {
+  return `pr create: head branch '${head}' is not on the remote \u2014 push the branch first`;
+}
+function emptyCompareMessage(base, head) {
+  return `pr create: no commits between ${base} and ${head} \u2014 push the branch first if those commits are only local`;
+}
+function humanPrCreateRemoteHeadError(text, args) {
+  if (!isPrCreateRemoteHeadGraphqlNoise(text)) return void 0;
+  const head = flagValue(args, "--head") ?? "the head branch";
+  const base = flagValue(args, "--base") ?? "the base";
+  if (/Head sha can't be blank/i.test(text) || /Head ref must be a branch/i.test(text)) {
+    return unpushedHeadMessage(head);
+  }
+  return emptyCompareMessage(base, head);
+}
+function isGhHttpNotFound(err) {
+  const text = execErrorText(err);
+  if (httpStatusCodes(text).includes(404)) return true;
+  return /HTTP\s*404|Not Found \(HTTP 404\)|\(404\)/i.test(text);
+}
+function isForkStyleHead(head) {
+  return head.includes(":");
+}
+async function defaultReadRemoteHead(exec, repo, head) {
+  try {
+    await exec("gh", ["api", `repos/${repo}/git/ref/heads/${encodeURIComponent(head)}`], { timeout: 15e3 });
+    return "present";
+  } catch (e) {
+    if (isGhHttpNotFound(e)) return "absent";
+    return "unknown";
+  }
+}
+async function defaultCompareRefs(exec, repo, base, head) {
+  try {
+    const { stdout } = await exec(
+      "gh",
+      ["api", `repos/${repo}/compare/${encodeURIComponent(base)}...${encodeURIComponent(head)}`],
+      { timeout: 15e3 }
+    );
+    const aheadBy = JSON.parse(stdout).ahead_by;
+    return typeof aheadBy === "number" ? { aheadBy } : "unknown";
+  } catch {
+    return "unknown";
+  }
+}
+async function preflightPrCreateRemoteHead(args, deps) {
+  const repo = flagValue(args, "--repo");
+  const head = flagValue(args, "--head");
+  if (!repo || !head || isForkStyleHead(head)) return void 0;
+  const readRemoteHead = deps.readRemoteHead ?? ((input) => defaultReadRemoteHead(deps.exec, input.repo, input.head));
+  const presence = await readRemoteHead({ repo, head });
+  if (presence === "absent") return unpushedHeadMessage(head);
+  if (presence !== "present") return void 0;
+  const base = flagValue(args, "--base");
+  if (!base) return void 0;
+  const compareRefs = deps.compareRefs ?? ((input) => defaultCompareRefs(deps.exec, input.repo, input.base, input.head));
+  const compared = await compareRefs({ repo, base, head });
+  if (compared !== "unknown" && compared.aheadBy <= 0) return emptyCompareMessage(base, head);
+  return void 0;
+}
 function buildPrCreateRetryCommand(args) {
   const parts = ["mmi-cli", "devops", "pr", "create"];
   for (const flag of ["--repo", "--base", "--head", "--title"]) {
@@ -11057,13 +11306,21 @@ async function createPrViaRestFallback(args, swappedArgs, deps, knownPools) {
 }
 async function ghCreate(args, deps = {}) {
   const exec = deps.exec ?? execFileP2;
-  const sleep2 = deps.sleep ?? ((ms) => new Promise((resolve5) => setTimeout(resolve5, ms)));
+  const sleep2 = deps.sleep ?? ((ms) => new Promise((resolve6) => setTimeout(resolve6, ms)));
   const now = deps.now ?? Date.now;
   const read = deps.readFile ?? import_promises.readFile;
   const restCreatePr = deps.restCreatePr ?? ((input) => defaultRestCreatePr(exec, input));
   const restCreateIssue = deps.restCreateIssue ?? ((input) => defaultRestCreateIssue(exec, input));
   const findOpenPr = deps.findOpenPr ?? ((input) => defaultFindOpenPr(exec, input));
   const readRateLimit = deps.readRateLimit ?? (() => defaultReadRateLimit(exec));
+  if (args[0] === "pr") {
+    const refusal = await preflightPrCreateRemoteHead(args, {
+      exec,
+      readRemoteHead: deps.readRemoteHead,
+      compareRefs: deps.compareRefs
+    });
+    if (refusal) return fail(refusal);
+  }
   const swapped = await bodyArgsViaFile(args);
   const restDeps = {
     exec,
@@ -11082,6 +11339,8 @@ async function ghCreate(args, deps = {}) {
     } catch (restErr) {
       await swapped.cleanup();
       const restText = execErrorText(restErr);
+      const humanRest = humanPrCreateRemoteHeadError(restText, args);
+      if (humanRest) return fail(humanRest);
       if (isGhRateLimitError(restText)) {
         const pools2 = await readRateLimit();
         return rateLimitedResult({
@@ -11172,6 +11431,10 @@ async function ghCreate(args, deps = {}) {
             message: `${context}: GraphQL rate-limited \u2014 ${rateLimitResetNote(pools.graphql?.reset ?? pools.core?.reset, now())}`
           });
         }
+        if (args[0] === "pr") {
+          const human = humanPrCreateRemoteHeadError(errText, args);
+          if (human) return fail(human);
+        }
         if (isUpstreamGitHubFault(faultText)) return fail(upstreamFaultMessage(args[0], faultText));
         return fail(`gh ${args[0]} create failed: ${(err.stderr || err.stdout || err.message || String(e)).trim()}${note ? ` (${note})` : ""}`);
       }
@@ -11204,9 +11467,9 @@ function isValidSecretKey(key) {
   return KEY_RE.test(key);
 }
 function classifyTier(_slug, key) {
-  const slash = key.indexOf("/");
-  if (slash === -1) return "project";
-  return key.slice(0, slash) === PROJECT_TIER_SEGMENT ? "project" : "org";
+  const slash2 = key.indexOf("/");
+  if (slash2 === -1) return "project";
+  return key.slice(0, slash2) === PROJECT_TIER_SEGMENT ? "project" : "org";
 }
 function secretParamName(slug, key) {
   return `${SSM_ROOT}/${slug}/${key}`;
@@ -11476,8 +11739,8 @@ async function probeCapabilities(deps, repo) {
   }
 }
 function secretKeyLeaf(key) {
-  const slash = key.lastIndexOf("/");
-  return slash === -1 ? key : key.slice(slash + 1);
+  const slash2 = key.lastIndexOf("/");
+  return slash2 === -1 ? key : key.slice(slash2 + 1);
 }
 function resolveNotFoundGuidance(input) {
   const { key, repo, slug, report } = input;
@@ -12147,8 +12410,8 @@ async function secretsRevoke(deps, repo, login, key, _opts) {
 }
 var SECRET_COPY_BLOCKED_RE = /(?:ENC_KEY|ENCRYPTION_KEY|SECRET_KEY_BASE)/i;
 function isSecretCopyBlocked(key) {
-  const slash = key.indexOf("/");
-  const leaf = slash === -1 ? key : key.slice(slash + 1);
+  const slash2 = key.indexOf("/");
+  const leaf = slash2 === -1 ? key : key.slice(slash2 + 1);
   return SECRET_COPY_BLOCKED_RE.test(leaf);
 }
 function copyTierKey(stage, leaf) {
@@ -12303,9 +12566,9 @@ function parseSecretsUseArgv(tail) {
   const flags = {};
   const keys = [];
   const firstSep = tail.indexOf("--");
-  const sep3 = firstSep !== -1 && separatorIsOurs(tail.slice(0, firstSep)) ? firstSep : -1;
-  const head = sep3 === -1 ? tail : tail.slice(0, sep3);
-  let command = sep3 === -1 ? [] : tail.slice(sep3 + 1).slice();
+  const sep4 = firstSep !== -1 && separatorIsOurs(tail.slice(0, firstSep)) ? firstSep : -1;
+  const head = sep4 === -1 ? tail : tail.slice(0, sep4);
+  let command = sep4 === -1 ? [] : tail.slice(sep4 + 1).slice();
   for (let i = 0; i < head.length; ) {
     const tok = head[i];
     const eq = tok.indexOf("=");
@@ -12367,8 +12630,8 @@ var PRE_SPAWN_DRAIN_TIMEOUT_MS = 2e3;
 async function drainHttpPoolBeforeSpawn() {
   const drained = await Promise.race([
     closeHttpPool().then(() => true),
-    new Promise((resolve5) => {
-      setTimeout(() => resolve5(false), PRE_SPAWN_DRAIN_TIMEOUT_MS).unref?.();
+    new Promise((resolve6) => {
+      setTimeout(() => resolve6(false), PRE_SPAWN_DRAIN_TIMEOUT_MS).unref?.();
     })
   ]);
   if (!drained) destroyHttpPool();
@@ -12868,10 +13131,10 @@ var rollout_plan_default = {
     note: "The v4.0.0 stamp happens at cut time (D6e #4463); until then the candidate is the origin/development head artifacts (built cli/dist + npm pack), identity proven by dist content hash (D6a)."
   },
   baseline: {
-    version: "4.1.2",
-    tag: "v4.1.2",
-    commit: "bb1a56a57cda",
-    npm: "@mutmutco/cli@4.1.2"
+    version: "4.1.4",
+    tag: "v4.1.4",
+    commit: "5b2b9ef75abf",
+    npm: "@mutmutco/cli@4.1.4"
   },
   exitCriterion: "fleet-n-of-n",
   hubOnlyShortcut: "forbidden",
@@ -12888,14 +13151,14 @@ var rollout_plan_default = {
           repo: "mutmutco/mmi-hub",
           role: "canary",
           schedule: "train",
-          v3Target: "v4.1.2"
+          v3Target: "v4.1.4"
         }
       ],
       rollbackTrigger: "Any red inside the post-contract soak window: `devops train gate` FAIL attributable to the v4 doors, Hub endpoint health probe failure, a pre-v4 client admitted instead of receiving actionable HTTP 426, or npm consumer install/doctor failure on the v4-only dist.",
       rollback: {
         independent: true,
-        mechanism: "npm dist-tag latest -> 4.1.2 and redeploy the Hub Lambda from tag v4.1.2 (bb1a56a57cda); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
-        v3Target: "v4.1.2 (@mutmutco/cli@4.1.2, tag commit bb1a56a57cda \u2014 last known-good release carrying the repo-index v4-only contract)"
+        mechanism: "npm dist-tag latest -> 4.1.4 and redeploy the Hub Lambda from tag v4.1.4 (5b2b9ef75abf); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
+        v3Target: "v4.1.4 (@mutmutco/cli@4.1.4, tag commit 5b2b9ef75abf \u2014 last known-good release carrying the repo-index v4-only contract)"
       }
     },
     {
@@ -13402,6 +13665,10 @@ var DEFAULT_LIMIT = 30;
 var MAX_LIMIT = 100;
 var CHILDREN_MAX_TOTAL = 100;
 var CHILDREN_MAX_DEPTH = 6;
+var BOARD_STATUS_ALIAS_BATCH = 25;
+var BOARD_STATUS_LOOKUP_CONCURRENCY = 3;
+var CHILD_PROJECT_ITEMS_PAGE = 50;
+var CHILD_PROJECT_ITEMS_FIELDS = `projectItems(first:${CHILD_PROJECT_ITEMS_PAGE}){nodes{project{id} fieldValues(first:20){nodes{... on ProjectV2ItemFieldSingleSelectValue{name field{...on ProjectV2SingleSelectField{name}}}}}}}`;
 var ISSUE_LIST_FIELDS = "number,title,state,url,assignees,labels";
 var PR_LIST_FIELDS = "number,title,state,url,headRefName,baseRefName";
 var QueryReadError = class extends Error {
@@ -13485,23 +13752,43 @@ async function runIssueList(deps, opts) {
   return shapeIssueList(rows);
 }
 function childrenGraphqlArgs(owner, name, number) {
-  const query = "query($owner:String!,$name:String!){repository(owner:$owner,name:$name){issue(number:" + number + "){number subIssues(first:100){nodes{number title state url assignees(first:10){nodes{login}} repository{nameWithOwner} projectItems(first:5){nodes{project{id} fieldValues(first:20){nodes{... on ProjectV2ItemFieldSingleSelectValue{name field{...on ProjectV2SingleSelectField{name}}}}}}} timelineItems(first:30,itemTypes:[CROSS_REFERENCED_EVENT]){nodes{...on CrossReferencedEvent{source{...on PullRequest{number title state url}}}}}}}}}}";
+  const query = "query($owner:String!,$name:String!){repository(owner:$owner,name:$name){issue(number:" + number + "){number subIssues(first:100){nodes{number title state url assignees(first:10){nodes{login}} repository{nameWithOwner} " + CHILD_PROJECT_ITEMS_FIELDS + " timelineItems(first:30,itemTypes:[CROSS_REFERENCED_EVENT]){nodes{...on CrossReferencedEvent{source{...on PullRequest{number title state url}}}}}}}}}}";
   return ["api", "graphql", "-f", `query=${query}`, "-f", `owner=${owner}`, "-f", `name=${name}`];
 }
-function shapeChildNode(node, depth, boardProjectId) {
-  const n = node ?? {};
-  const assigneeNodes = n.assignees?.nodes ?? [];
-  let boardStatus = null;
-  for (const pi of n.projectItems?.nodes ?? []) {
-    if (!boardProjectId || pi?.project?.id !== boardProjectId) continue;
+function childrenBoardStatusGraphqlArgs(owner, name, numbers) {
+  const aliases = numbers.map((n, i) => `i${i}:issue(number:${n}){number ${CHILD_PROJECT_ITEMS_FIELDS}}`).join(" ");
+  const query = `query($owner:String!,$name:String!){repository(owner:$owner,name:$name){${aliases}}}`;
+  return ["api", "graphql", "-f", `query=${query}`, "-f", `owner=${owner}`, "-f", `name=${name}`];
+}
+function boardStatusFromProjectItems(nodes, boardProjectId) {
+  if (!boardProjectId) return null;
+  for (const pi of Array.isArray(nodes) ? nodes : []) {
+    if (pi?.project?.id !== boardProjectId) continue;
     const status = (pi?.fieldValues?.nodes ?? []).find(
       (fv) => fv?.field?.name === "Status" && fv?.name
     );
-    if (status) {
-      boardStatus = String(status.name);
-      break;
-    }
+    if (status) return String(status.name);
+  }
+  return null;
+}
+function extractIssueBoardStatusMap(resp, boardProjectId) {
+  const map = /* @__PURE__ */ new Map();
+  const repo = resp?.data?.repository;
+  if (!repo || typeof repo !== "object") return map;
+  for (const node of Object.values(repo)) {
+    if (!node || typeof node !== "object") continue;
+    const n = node;
+    const number = Number(n.number);
+    if (!Number.isFinite(number)) continue;
+    const status = boardStatusFromProjectItems(n.projectItems?.nodes, boardProjectId);
+    if (status) map.set(number, status);
   }
+  return map;
+}
+function shapeChildNode(node, depth, boardProjectId) {
+  const n = node ?? {};
+  const assigneeNodes = n.assignees?.nodes ?? [];
+  const boardStatus = boardStatusFromProjectItems(n.projectItems?.nodes, boardProjectId);
   const linkedPrs = [];
   const seenPr = /* @__PURE__ */ new Set();
   for (const ev of n.timelineItems?.nodes ?? []) {
@@ -13550,6 +13837,42 @@ async function queryChildren(deps, owner, name, number) {
   }
   return extractChildrenResponse(resp);
 }
+async function fillMissingChildBoardStatus(deps, children, boardProjectId) {
+  if (!boardProjectId) return;
+  const missing = children.filter((c) => !c.boardStatus && trySplitRepo(c.repo));
+  if (!missing.length) return;
+  const byRepo = /* @__PURE__ */ new Map();
+  for (const c of missing) {
+    const nums = byRepo.get(c.repo) ?? [];
+    if (!nums.includes(c.number)) nums.push(c.number);
+    byRepo.set(c.repo, nums);
+  }
+  const jobs = [];
+  for (const [repo, numbers] of byRepo) {
+    for (let i = 0; i < numbers.length; i += BOARD_STATUS_ALIAS_BATCH) {
+      jobs.push({ repo, numbers: numbers.slice(i, i + BOARD_STATUS_ALIAS_BATCH) });
+    }
+  }
+  const maps = await mapBounded(jobs, BOARD_STATUS_LOOKUP_CONCURRENCY, async (job) => {
+    try {
+      const { owner, name } = splitRepo(job.repo);
+      const resp = await deps.ghJson(childrenBoardStatusGraphqlArgs(owner, name, job.numbers), GH_LIST_TIMEOUT_MS);
+      return extractIssueBoardStatusMap(resp, boardProjectId);
+    } catch {
+      return /* @__PURE__ */ new Map();
+    }
+  });
+  const resolved = /* @__PURE__ */ new Map();
+  for (let i = 0; i < jobs.length; i++) {
+    const job = jobs[i];
+    for (const [num, status] of maps[i] ?? []) resolved.set(childKey(job.repo, num), status);
+  }
+  for (const c of children) {
+    if (c.boardStatus) continue;
+    const status = resolved.get(childKey(c.repo, c.number));
+    if (status) c.boardStatus = status;
+  }
+}
 async function runIssueChildren(deps, epic, opts) {
   const ref = parseIssueRef(epic);
   const repo = ref.repo ?? await deps.resolveRepo(void 0);
@@ -13566,7 +13889,10 @@ async function runIssueChildren(deps, epic, opts) {
     out.push(child2);
     seen.add(childKey(child2.repo, child2.number));
   }
-  if (!opts.recursive || out.length >= CHILDREN_MAX_TOTAL) return out;
+  if (!opts.recursive || out.length >= CHILDREN_MAX_TOTAL) {
+    await fillMissingChildBoardStatus(deps, out, boardProjectId);
+    return out;
+  }
   const queue = [];
   for (const child2 of out) {
     const sp = trySplitRepo(child2.repo);
@@ -13592,6 +13918,7 @@ async function runIssueChildren(deps, epic, opts) {
       if (sp) queue.push({ owner: sp.owner, name: sp.name, number: child2.number, depth: frame.depth + 1 });
     }
   }
+  await fillMissingChildBoardStatus(deps, out, boardProjectId);
   return out;
 }
 var FRONTIER_BUCKET_ORDER = {
@@ -13990,7 +14317,7 @@ function registerQueryCommands(program3) {
       queryFail("issue list", e);
     }
   });
-  issue2.command("children <epic>").description("walk an epic's native sub-issue tree \u2014 each child: number/title/state/repo/assignee/boardStatus/linkedPrs; --recursive walks deeper").option("--recursive", "walk the full sub-issue tree (bounded depth + total cap)").option("--repo <owner/repo>", "repo for a bare epic ref (defaults to the current repo)").option("--json", "machine-readable output (already the default \u2014 accepted for contract uniformity)").action(async (epic, o) => {
+  issue2.command("children <epic>").description("walk an epic's native sub-issue tree \u2014 each child: number/title/state/repo/assignee/boardStatus/linkedPrs (boardStatus null is inconclusive, not off-board); --recursive walks deeper").option("--recursive", "walk the full sub-issue tree (bounded depth + total cap)").option("--repo <owner/repo>", "repo for a bare epic ref (defaults to the current repo)").option("--json", "machine-readable output (already the default \u2014 accepted for contract uniformity)").action(async (epic, o) => {
     try {
       const childrenDeps = { ...deps, resolveRepo: async (r) => deps.resolveRepo(r ?? o.repo) };
       const boardProjectId = await resolveBoardProjectId(o.repo);
@@ -14913,6 +15240,183 @@ rollback stays available: mmi-cli devops train enforce --apply --disarm`
   });
 }
 
+// src/actions-billing-preflight.ts
+var CANARY_WORKFLOW = "actions-job-start-canary.yml";
+var CANARY_REPO = "mutmutco/MMI-Hub";
+var ACTIONS_BILLING_BLOCK_RE = /job was not started because recent account payments have failed|account payments have failed|spending limit needs to be increased|Billing & plans/i;
+var CANARY_POLLS = 20;
+var CANARY_POLL_MS = 1e3;
+function isActionsBillingBlockText(text) {
+  return ACTIONS_BILLING_BLOCK_RE.test(text);
+}
+function interpretActionsJobStart(input) {
+  const text = input.text ?? "";
+  if (isActionsBillingBlockText(text)) return "billing-blocked";
+  const jobs = input.jobs ?? [];
+  if (jobs.some((job) => isActionsBillingBlockText(JSON.stringify(job)))) return "billing-blocked";
+  if (jobs.some((job) => Array.isArray(job.steps) && job.steps.length > 0 || Boolean(job.startedAt))) {
+    return "started";
+  }
+  if (jobs.length > 0 && jobs.every((job) => {
+    const finished = job.conclusion === "failure" || job.status === "completed";
+    const empty = !Array.isArray(job.steps) || job.steps.length === 0;
+    return finished && empty && !job.startedAt;
+  })) {
+    return "never-started";
+  }
+  return "pending";
+}
+function actionsBillingRefusal(detail) {
+  return new Error(
+    `release refused: GitHub Actions cannot start a hosted job (billing/spending). ${detail} Fix Billing & plans / the org spending limit, then rerun. Do not mint a new tag. If a tag is already on origin, use \`mmi-cli devops release --retry-publish <run-id> --apply\` on that exact run \u2014 never recut.`
+  );
+}
+function parseJson(raw, label) {
+  try {
+    return JSON.parse(raw);
+  } catch {
+    throw new Error(`${label} was not valid JSON`);
+  }
+}
+async function scanRepoForBillingBlock(deps, repo) {
+  let raw;
+  try {
+    raw = await deps.run("gh", [
+      "run",
+      "list",
+      "--repo",
+      repo,
+      "--limit",
+      "8",
+      "--json",
+      "databaseId,conclusion,status,displayTitle,url"
+    ]);
+  } catch {
+    return void 0;
+  }
+  const rows = parseJson(raw, `gh run list --repo ${repo}`);
+  if (!Array.isArray(rows)) return void 0;
+  for (const row of rows) {
+    const blob = `${row.displayTitle ?? ""} ${row.conclusion ?? ""} ${row.url ?? ""}`;
+    if (isActionsBillingBlockText(blob)) {
+      return `${repo} run ${row.databaseId ?? row.url ?? "(unknown)"} already names a billing/spending block`;
+    }
+    if (row.conclusion !== "failure" && row.status !== "completed") continue;
+    if (typeof row.databaseId !== "number") continue;
+    try {
+      const view = await deps.run("gh", [
+        "run",
+        "view",
+        String(row.databaseId),
+        "--repo",
+        repo,
+        "--json",
+        "jobs,conclusion,displayTitle,url"
+      ]);
+      const parsed = parseJson(view, `gh run view ${row.databaseId}`);
+      const verdict = interpretActionsJobStart({
+        jobs: parsed.jobs,
+        text: `${parsed.displayTitle ?? ""} ${parsed.conclusion ?? ""} ${view}`
+      });
+      if (verdict === "billing-blocked" || verdict === "never-started") {
+        return `${repo} run ${row.databaseId} (${parsed.url ?? row.url ?? "no url"}): hosted job never started` + (verdict === "billing-blocked" ? " (billing/spending refusal)" : " (empty steps)");
+      }
+    } catch {
+    }
+  }
+  return void 0;
+}
+async function correlateCanaryRun(deps, nonce) {
+  const sleep2 = deps.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+  let lastError = "no matching canary run";
+  for (let attempt = 0; attempt < 8; attempt++) {
+    if (attempt > 0) await sleep2(CANARY_POLL_MS);
+    let raw;
+    try {
+      raw = await deps.run("gh", [
+        "run",
+        "list",
+        "--repo",
+        CANARY_REPO,
+        "--workflow",
+        CANARY_WORKFLOW,
+        "--limit",
+        "10",
+        "--json",
+        "databaseId,displayTitle,status,createdAt"
+      ]);
+    } catch (e) {
+      lastError = e instanceof Error ? e.message : String(e);
+      continue;
+    }
+    const rows = parseJson(
+      raw,
+      "canary gh run list"
+    );
+    const match = rows.find((row) => (row.displayTitle ?? "").includes(nonce) && typeof row.databaseId === "number");
+    if (match?.databaseId) return match.databaseId;
+  }
+  throw new Error(
+    `could not correlate ${CANARY_WORKFLOW} on ${CANARY_REPO} (nonce ${nonce}): ${lastError}`
+  );
+}
+async function assertActionsJobsCanStart(deps, targetRepo3) {
+  const scanned = await scanRepoForBillingBlock(deps, targetRepo3);
+  if (scanned) throw actionsBillingRefusal(scanned);
+  if (targetRepo3.toLowerCase() !== CANARY_REPO.toLowerCase()) {
+    const hubScan = await scanRepoForBillingBlock(deps, CANARY_REPO);
+    if (hubScan) throw actionsBillingRefusal(hubScan);
+  }
+  const nonce = `5604-${(deps.now ?? Date.now)().toString(36)}`;
+  try {
+    await deps.run("gh", [
+      "workflow",
+      "run",
+      CANARY_WORKFLOW,
+      "--repo",
+      CANARY_REPO,
+      "-f",
+      `nonce=${nonce}`
+    ]);
+  } catch (e) {
+    throw actionsBillingRefusal(
+      `could not dispatch ${CANARY_WORKFLOW} on ${CANARY_REPO}: ${e instanceof Error ? e.message : String(e)}. A hosted publish job may not start (the v1.54.2 class).`
+    );
+  }
+  const runId = await correlateCanaryRun(deps, nonce);
+  const sleep2 = deps.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+  let last = "pending";
+  let url = `https://github.com/${CANARY_REPO}/actions/runs/${runId}`;
+  for (let attempt = 0; attempt < CANARY_POLLS; attempt++) {
+    if (attempt > 0) await sleep2(CANARY_POLL_MS);
+    const view = await deps.run("gh", [
+      "run",
+      "view",
+      String(runId),
+      "--repo",
+      CANARY_REPO,
+      "--json",
+      "jobs,status,conclusion,url,displayTitle"
+    ]);
+    const parsed = parseJson(view, `canary gh run view ${runId}`);
+    if (parsed.url) url = parsed.url;
+    last = interpretActionsJobStart({
+      jobs: parsed.jobs,
+      text: `${parsed.displayTitle ?? ""} ${parsed.conclusion ?? ""} ${view}`
+    });
+    if (last === "started") {
+      await deps.run("gh", ["run", "cancel", String(runId), "--repo", CANARY_REPO]).catch(() => "");
+      return;
+    }
+    if (last === "billing-blocked" || last === "never-started") {
+      throw actionsBillingRefusal(`${url}: hosted canary ${last}`);
+    }
+  }
+  throw actionsBillingRefusal(
+    `${url}: hosted canary stayed ${last} after ${CANARY_POLLS} polls \u2014 cannot prove a hosted job can start`
+  );
+}
+
 // src/train-apply.ts
 var TRAIN_BUMP_INTENTS = ["major", "minor", "patch"];
 function reduceFollowUpOutcomes(outcomes) {
@@ -15298,7 +15802,7 @@ async function runMergeTreePreflight(deps, ours, theirs) {
 async function predictMergeConflicts(deps, ours, theirs) {
   return runMergeTreePreflight(deps, ours, theirs);
 }
-async function mergeWithToleratedResolution(deps, sourceRef, label, resolve5, extraTolerated = []) {
+async function mergeWithToleratedResolution(deps, sourceRef, label, resolve6, extraTolerated = []) {
   try {
     await deps.run("git", ["merge", sourceRef, "--no-edit"]);
     return;
@@ -15312,7 +15816,7 @@ async function mergeWithToleratedResolution(deps, sourceRef, label, resolve5, ex
       unmerged.length === 0 ? `${label} merge failed without conflicted paths \u2014 merge aborted; inspect the repo state and rerun` : `${label} merge conflicts on untolerated path(s): ${blocking.join(", ")} \u2014 merge aborted (the train is misaligned; reconcile the branches via an approved alignment PR, then rerun)`
     );
   }
-  await deps.run("git", ["checkout", `--${resolve5}`, "--", ...unmerged]);
+  await deps.run("git", ["checkout", `--${resolve6}`, "--", ...unmerged]);
   await deps.run("git", ["add", "--", ...unmerged]);
   await deps.run("git", ["commit", "--no-edit"]);
 }
@@ -15460,7 +15964,7 @@ var CORRELATE_SKEW_SLACK_MS = 1e4;
 var CORRELATE_PAGE_LIMIT = 50;
 var RUN_CONFIRM_ATTEMPTS = 3;
 var RUN_CONFIRM_DELAY_MS = 1e3;
-var defaultSleep = (ms) => new Promise((resolve5) => setTimeout(resolve5, ms));
+var defaultSleep = (ms) => new Promise((resolve6) => setTimeout(resolve6, ms));
 function resolveSleep(deps) {
   return deps.sleep ?? defaultSleep;
 }
@@ -16348,6 +16852,7 @@ async function preflight(deps, ctx, stage, meta) {
     throw new Error(`${ctx.repo} is not Hub-deployed (deployModel=none) \u2014 the release train does not apply; use the project's own release path`);
   }
   await deps.runSelf(["secrets", "preflight", "--stage", stage, "--repo", ctx.repo]);
+  await assertActionsJobsCanStart(deps, ctx.repo);
   enforceGateBudget(deps, ctx.repo);
   if (model === "hub-serverless") {
     await deps.run("node", ["scripts/release-distribution.mjs", "verify-deps"]);
@@ -18525,7 +19030,7 @@ async function mergeAutoWithTransientRetry(prNumber, repo, deps) {
   if (first.mergeStatus !== "failed") return first;
   const ready = await deps.probeMergeReady(prNumber, repo).catch(() => ({ open: false, mergeable: false, checksPassing: false }));
   if (!ready.open || !ready.mergeable || !ready.checksPassing) return first;
-  const sleep2 = deps.sleep ?? ((ms) => new Promise((resolve5) => setTimeout(resolve5, ms)));
+  const sleep2 = deps.sleep ?? ((ms) => new Promise((resolve6) => setTimeout(resolve6, ms)));
   await sleep2(PR_LAND_MERGE_RETRY_DELAY_MS);
   const retried = await deps.mergeAuto(prNumber, repo);
   if (retried.mergeStatus !== "failed") return retried;
@@ -18536,7 +19041,7 @@ var AUTO_MERGE_CONFIRM_DELAY_MS = 3e3;
 async function confirmAutoMergeEnqueued(deps, options) {
   const retries = options?.retries ?? AUTO_MERGE_CONFIRM_RETRIES;
   const delayMs = options?.delayMs ?? AUTO_MERGE_CONFIRM_DELAY_MS;
-  const sleep2 = deps.sleep ?? ((ms) => new Promise((resolve5) => setTimeout(resolve5, ms)));
+  const sleep2 = deps.sleep ?? ((ms) => new Promise((resolve6) => setTimeout(resolve6, ms)));
   for (let attempt = 0; attempt < retries; attempt++) {
     if (await deps.readMerged().catch(() => false)) return "merged";
     const stuck = await deps.readAutoMergeRequest().then((s) => s.trim()).catch(() => "");
@@ -18553,7 +19058,7 @@ async function confirmAutoMergeEnqueued(deps, options) {
 async function readGhPrStateWithRetry(fetchState, options) {
   const retries = options?.retries ?? PR_LAND_STATE_READ_RETRIES;
   const delayMs = options?.delayMs ?? PR_LAND_STATE_READ_DELAY_MS;
-  const sleep2 = options?.sleep ?? ((ms) => new Promise((resolve5) => setTimeout(resolve5, ms)));
+  const sleep2 = options?.sleep ?? ((ms) => new Promise((resolve6) => setTimeout(resolve6, ms)));
   let lastError = "empty state";
   for (let attempt = 0; attempt < retries; attempt++) {
     try {
@@ -18687,7 +19192,7 @@ function healthPollIntervalMs() {
   return HEALTH_POLL_INTERVAL_MS;
 }
 function waitForProcessStability(child2, graceMs = earlyExitGraceMs()) {
-  return new Promise((resolve5, reject) => {
+  return new Promise((resolve6, reject) => {
     let settled = false;
     const finish = (fn) => {
       if (settled) return;
@@ -18697,7 +19202,7 @@ function waitForProcessStability(child2, graceMs = earlyExitGraceMs()) {
       child2.removeAllListeners("exit");
       fn();
     };
-    const timer = setTimeout(() => finish(resolve5), graceMs);
+    const timer = setTimeout(() => finish(resolve6), graceMs);
     child2.on("error", (err) => finish(() => reject(new Error(`stage process failed to start: ${err.message}`))));
     child2.on("exit", (code, signal) => {
       const detail = code != null ? `code ${code}` : signal ? `signal ${signal}` : "unknown reason";
@@ -18903,10 +19408,10 @@ function pickStagePort(range, isFree) {
   throw new Error(`no free stage port in range ${start}-${end} \u2014 every port is in use`);
 }
 function isPortFree(port) {
-  return new Promise((resolve5) => {
+  return new Promise((resolve6) => {
     const srv = (0, import_node_net.createServer)();
-    srv.once("error", () => resolve5(false));
-    srv.once("listening", () => srv.close(() => resolve5(true)));
+    srv.once("error", () => resolve6(false));
+    srv.once("listening", () => srv.close(() => resolve6(true)));
     srv.listen(port, "127.0.0.1");
   });
 }
@@ -19117,7 +19622,7 @@ async function killTree(pid) {
     } catch {
     }
   }
-  await new Promise((resolve5) => setTimeout(resolve5, 500));
+  await new Promise((resolve6) => setTimeout(resolve6, 500));
   try {
     process.kill(-pid, "SIGKILL");
   } catch {
@@ -19138,7 +19643,7 @@ async function waitForHealth(url, timeoutMs, anyStatus = false) {
     } catch (e) {
       last = e.message;
     }
-    await new Promise((resolve5) => setTimeout(resolve5, healthPollIntervalMs()));
+    await new Promise((resolve6) => setTimeout(resolve6, healthPollIntervalMs()));
   }
   throw new Error(`stage health check timed out for ${url}${last ? ` (${last})` : ""}`);
 }
@@ -19373,12 +19878,12 @@ async function executeWaveLand(plan, deps) {
 }
 
 // src/index.ts
-var import_node_os19 = require("node:os");
+var import_node_os21 = require("node:os");
 
 // src/board.ts
 var import_node_child_process9 = require("node:child_process");
-var import_node_fs19 = require("node:fs");
-var import_node_os8 = require("node:os");
+var import_node_fs20 = require("node:fs");
+var import_node_os9 = require("node:os");
 var import_node_path17 = require("node:path");
 var import_node_util6 = require("node:util");
 init_github_client();
@@ -19389,8 +19894,10 @@ init_client_version();
 var BOARD_SNAPSHOT_TIMEOUT_MS = 25e3;
 function isSnapshotShape(body) {
   const b = body;
+  const rate = b?.github?.rateLimit;
+  const githubValid = b?.github === void 0 || b.github.credential === "app_installation" && Number.isFinite(rate?.limit) && Number.isFinite(rate?.remaining) && Number.isFinite(rate?.cost) && typeof rate?.resetAt === "string";
   return Boolean(
-    b && typeof b === "object" && typeof b.project?.id === "string" && typeof b.project?.title === "string" && typeof b.viewer === "string" && b.viewer.length > 0 && Array.isArray(b.nodes) && Array.isArray(b.writableRepos) && Array.isArray(b.unreadableRepos) && Array.isArray(b.pullRequests) && Array.isArray(b.warnings) && typeof b.partial === "boolean"
+    b && typeof b === "object" && typeof b.project?.id === "string" && typeof b.project?.title === "string" && typeof b.viewer === "string" && b.viewer.length > 0 && Array.isArray(b.nodes) && Array.isArray(b.writableRepos) && Array.isArray(b.unreadableRepos) && Array.isArray(b.pullRequests) && Array.isArray(b.warnings) && typeof b.partial === "boolean" && githubValid
   );
 }
 async function fetchHubBoardSnapshot(request, deps) {
@@ -19824,7 +20331,7 @@ async function postIssueComment(client, input) {
 var SKILL_LESSON_LABEL = "skill-lesson";
 var SKILL_LESSON_FILE_LABELS = [SKILL_LESSON_LABEL, LEARNING_LABEL];
 var SKILL_LESSON_LOOP_KIND = "lesson";
-var SKILL_NAMES = ["bootstrap", "browser-automation", "doctor", "epic", "hotfix", "mmi", "onboard", "rcand", "release", "resume", "secrets", "stage"];
+var SKILL_NAMES = ["bootstrap", "browser-automation", "doctor", "epic", "hotfix", "mmi", "onboard", "rcand", "release", "repo-index-audit", "resume", "secrets", "stage"];
 function assertSkillName(name) {
   const match = SKILL_NAMES.find((skill) => skill === name);
   if (!match) throw new Error(`unknown skill "${name}" \u2014 expected one of: ${SKILL_NAMES.join(", ")}`);
@@ -19856,7 +20363,7 @@ function findDuplicateLesson(source, openLessons) {
 
 // src/session-identity.ts
 var import_node_crypto4 = require("node:crypto");
-var import_node_os7 = require("node:os");
+var import_node_os8 = require("node:os");
 init_plugin_guard_io();
 var SESSION_ID_ENV_VARS = [
   "MMI_SESSION_ID",
@@ -19892,7 +20399,7 @@ function describeSessionIdentity(env = process.env) {
   return {
     session: readSessionId(env) ?? fallbackSessionId(surface),
     surface,
-    host: (0, import_node_os7.hostname)()
+    host: (0, import_node_os8.hostname)()
   };
 }
 
@@ -20173,6 +20680,10 @@ function renderBoardItem(item) {
 }
 function renderBoardReport(report) {
   const lines = [`Board \xB7 ${report.project.title} \xB7 @${report.viewer}`, renderBoardSource()];
+  if (report.github) {
+    const { limit, remaining, cost, resetAt } = report.github.rateLimit;
+    lines.push(`github: app installation \xB7 GraphQL ${remaining}/${limit} remaining \xB7 cost ${cost} \xB7 resets ${resetAt}`);
+  }
   renderScope(lines, "PRIMARY", report.repo, report.primary, report.viewer);
   renderScope(lines, "SECONDARY", "Other repos on this project", report.secondary, report.viewer);
   if (report.warnings.length) {
@@ -20285,6 +20796,7 @@ async function readBoard(options, deps = {}) {
   let collected;
   let writable;
   let pullRequests;
+  let github;
   let snapshotFallback;
   const attempt = deps.snapshot ? await fetchHubBoardSnapshot(
     {
@@ -20329,6 +20841,7 @@ async function readBoard(options, deps = {}) {
       unknown: new Set(snapshot.unreadableRepos.map((entry) => entry.repo.toLowerCase()))
     };
     pullRequests = snapshot.pullRequests;
+    github = snapshot.github;
   } else {
     if (attempt?.state === "unavailable") snapshotFallback = attempt.reason;
     collected = await collectBoardItems(cfg, { repo: options.repo, allowPartial: options.allowPartial, activeOnly: true }, deps);
@@ -20349,7 +20862,8 @@ async function readBoard(options, deps = {}) {
     warnings: collected.warnings,
     partial: collected.partial,
     source: "live",
-    ...pullRequests ? { pullRequests } : {}
+    ...pullRequests ? { pullRequests } : {},
+    ...github ? { github } : {}
   };
   if (options.includeBundleDetails || options.includeAllBodies) {
     await attachBundleDetails(report, client, options.allowPartial ?? false, { all: options.includeAllBodies });
@@ -20521,7 +21035,14 @@ async function prepareClaimContext(options, selectors, deps, collected) {
     report[scope].claimable = filtered.claimable;
     report.warnings.push(...filtered.warnings);
   }
-  return { cfg, client, items: collected.items, writable: writableOrUnknown(writable), report };
+  return {
+    cfg,
+    client,
+    items: collected.items,
+    writable: writableOrUnknown(writable),
+    report,
+    session: deps.session ?? describeSessionIdentity()
+  };
 }
 async function claimOneBoardItem(ctx, selector, options) {
   const { cfg, client, report } = ctx;
@@ -20566,26 +21087,29 @@ async function claimOneBoardItem(ctx, selector, options) {
   const verdict = evaluateClaim(fresh, assignedLogin);
   if (!verdict.ok) throw new Error(verdict.reason);
   item = fresh;
+  const refuseIfContested = async () => {
+    if (options.force) return;
+    const contest = await checkLaneContest(client, item, ctx.session);
+    if (contest.contested) throw new Error(laneContestMessage(item.ref, contest, "claim"));
+  };
+  await refuseIfContested();
   if (verdict.alreadyClaimed) {
-    if (!options.force) {
-      const contest = await checkLaneContest(client, item);
-      if (contest.contested) throw new Error(laneContestMessage(item.ref, contest, "claim"));
-    }
     if (options.check) {
       return { item, viewer: report.viewer, repo: report.repo, status: "In Progress", partial: false, alreadyClaimed: true, checked: true };
     }
-    await postClaimMarkerComment(client, item);
+    await postClaimMarkerComment(client, item, ctx.session);
     return { item, viewer: report.viewer, repo: report.repo, status: "In Progress", partial: false, alreadyClaimed: true };
   }
   if (options.check) {
     return { item, viewer: report.viewer, repo: report.repo, status: item.status, partial: false, checked: true };
   }
+  await refuseIfContested();
   try {
     await client.rest("POST", `repos/${item.repository}/issues/${item.number}/assignees`, { body: { assignees: [assignedLogin] } });
   } catch (e) {
     throw new Error(`claim failed before board status changed: ${ghError(e)}`);
   }
-  await postClaimMarkerComment(client, item);
+  await postClaimMarkerComment(client, item, ctx.session);
   try {
     await updateItemSingleSelect(client, cfg.projectId, item.itemId, cfg.statusFieldId, cfg.statusOptions["In Progress"]);
   } catch (e) {
@@ -20778,7 +21302,7 @@ async function setBoardItemPriority(client, cfg, itemId, priority) {
   await updateItemSingleSelect(client, cfg.projectId, itemId, cfg.priorityFieldId, optionId);
   return cliPriorityToFieldName(priority);
 }
-var defaultRetrySleep = (ms) => new Promise((resolve5) => setTimeout(resolve5, ms));
+var defaultRetrySleep = (ms) => new Promise((resolve6) => setTimeout(resolve6, ms));
 async function resolveProjectItemIdWithRetry(client, cfg, selector, opts = {}) {
   const attempts = Math.max(1, opts.attempts ?? 5);
   const delayMs = opts.delayMs ?? 300;
@@ -21211,9 +21735,8 @@ function boardItemClaim(item) {
     currentlyClaimed: item.assignees.length > 0 && item.status === "In Progress"
   };
 }
-async function postClaimMarkerComment(client, item) {
+async function postClaimMarkerComment(client, item, actor = describeSessionIdentity()) {
   try {
-    const actor = describeSessionIdentity();
     const marker = {
       v: 1,
       session: actor.session,
@@ -21236,7 +21759,7 @@ var CLAIM_SESSION_ACTIVITY_MS = 30 * 6e4;
 var CLAIM_SESSION_PROBE_CACHE_MS = 6e4;
 var claimSessionProbeCache = /* @__PURE__ */ new Map();
 function probeLocalClaimSession(marker, now = Date.now()) {
-  if (!marker.session || !marker.host || marker.host.toLowerCase() !== (0, import_node_os8.hostname)().toLowerCase()) return void 0;
+  if (!marker.session || !marker.host || marker.host.toLowerCase() !== (0, import_node_os9.hostname)().toLowerCase()) return void 0;
   if (!marker.surface?.toLowerCase().startsWith("claude")) return void 0;
   const cacheKey = `${marker.host.toLowerCase()}/${marker.session}`;
   const cached = claimSessionProbeCache.get(cacheKey);
@@ -21245,17 +21768,17 @@ function probeLocalClaimSession(marker, now = Date.now()) {
     claimSessionProbeCache.set(cacheKey, { checkedAt: now, state });
     return state;
   };
-  const root = (0, import_node_path17.join)((0, import_node_os8.homedir)(), ".claude", "projects");
+  const root = (0, import_node_path17.join)((0, import_node_os9.homedir)(), ".claude", "projects");
   try {
     const wanted = `${marker.session}.jsonl`.toLowerCase();
     const pending = [root];
     while (pending.length) {
       const dir = pending.pop();
-      for (const entry of (0, import_node_fs19.readdirSync)(dir, { withFileTypes: true })) {
+      for (const entry of (0, import_node_fs20.readdirSync)(dir, { withFileTypes: true })) {
         const path2 = (0, import_node_path17.join)(dir, entry.name);
         if (entry.isDirectory()) pending.push(path2);
         else if (entry.isFile() && entry.name.toLowerCase() === wanted) {
-          return remember(now - (0, import_node_fs19.statSync)(path2).mtimeMs <= CLAIM_SESSION_ACTIVITY_MS ? "live" : "dead");
+          return remember(now - (0, import_node_fs20.statSync)(path2).mtimeMs <= CLAIM_SESSION_ACTIVITY_MS ? "live" : "dead");
         }
       }
     }
@@ -21367,9 +21890,8 @@ function laneOwnership(marker, current) {
   }
   return "unknown";
 }
-async function checkLaneContest(client, item) {
+async function checkLaneContest(client, item, actor = describeSessionIdentity()) {
   const evidence = await gatherClaimLiveness(client, item.repository, item.number, openPullsFetcher(client));
-  const actor = describeSessionIdentity();
   const ownership = laneOwnership(evidence.marker, actor);
   const live = ownership === "mine" ? [] : liveEvidenceLines(evidence, item.repository);
   const unverifiable = ownership === "mine" ? [] : evidence.failed;
@@ -21567,7 +22089,7 @@ async function resolveAutoAddBoardAttach(client, cfg, selector, priority, warn =
 }
 
 // src/issue-body.ts
-var import_node_os9 = require("node:os");
+var import_node_os10 = require("node:os");
 init_error_codes();
 var TextArgError = class extends Error {
   constructor(message, code, offendingFlag) {
@@ -21580,7 +22102,7 @@ var TextArgError = class extends Error {
   offendingFlag;
 };
 function emptyStdinMessage(fileFlag) {
-  if ((0, import_node_os9.platform)() === "win32") {
+  if ((0, import_node_os10.platform)() === "win32") {
     return `${fileFlag} - read empty stdin (on Windows, ${fileFlag} - is unreliable through the npm .cmd shim \u2014 use ${fileFlag} <path>, or pipe to \`node cli/dist/index.cjs\` directly)`;
   }
   return `${fileFlag} - read empty stdin (nothing piped \u2014 pass a heredoc/pipe, or ${fileFlag} <path>)`;
@@ -21681,12 +22203,13 @@ var PRIMARY_GROUPS = [
   ["Review and ship", ["pr", "ci", "rcand", "release", "hotfix", "train"]],
   // `tests` sits beside `docs` deliberately: both are deterministic, repo-local gates a workflow
   // step invokes (`docs refs`, `tests policy`), not org-plane operations (#3605). `spawn policy`
-  // joins them on the same footing (#3979).
-  ["Setup and support", ["bootstrap", "secrets", "docs", "repo-index", "tests", "spawn"]],
+  // joins them on the same footing (#3979); `dist status` does too (#5576) — the checkout's own
+  // dist/BOM freshness read.
+  ["Setup and support", ["bootstrap", "secrets", "docs", "repo-index", "tests", "spawn", "dist"]],
   ["Coordinate and improve", ["wave", "report", "skill-lesson", "closure-rate"]]
 ];
 var OPERATIONAL_TOP_LEVEL = /* @__PURE__ */ new Set(["org", "runtime", "plugin"]);
-var SUPPORT_PRIMARY = /* @__PURE__ */ new Set(["doctor", "whoami", "commands", "explain", "docs", "repo-index", "find", "tests", "spawn", "wave", "report", "skill-lesson", "closure-rate"]);
+var SUPPORT_PRIMARY = /* @__PURE__ */ new Set(["doctor", "whoami", "commands", "explain", "docs", "repo-index", "find", "tests", "spawn", "dist", "wave", "report", "skill-lesson", "closure-rate"]);
 var TOP_LEVEL_ORDER = /* @__PURE__ */ new Map();
 var HELP_GROUP_ORDER = /* @__PURE__ */ new Map();
 var topLevelPosition = 0;
@@ -21739,6 +22262,7 @@ var COMMAND_OWNERSHIP = {
   find: { module_owner: "cli/src/repo-index.ts", consumer: "agent-session" },
   tests: { module_owner: "cli/src/test-policy-core.ts", consumer: "repo-gates" },
   spawn: { module_owner: "cli/src/spawn-policy-core.ts", consumer: "repo-gates" },
+  dist: { module_owner: "cli/src/dist-drift.ts", consumer: "repo-gates" },
   wave: { module_owner: "cli/src/wave-land.ts", consumer: "campaign-orchestrator" },
   report: { module_owner: "cli/src/report.ts", consumer: "campaign-orchestrator" },
   "skill-lesson": { module_owner: "cli/src/skill-lesson.ts", consumer: "campaign-orchestrator" },
@@ -22260,13 +22784,13 @@ init_hub_url();
 init_client_version();
 
 // src/claude-binary-doctor.ts
-var import_node_fs21 = require("node:fs");
-var import_node_os11 = require("node:os");
+var import_node_fs22 = require("node:fs");
+var import_node_os12 = require("node:os");
 var import_node_path19 = require("node:path");
 
 // src/jerv-cli-spawn.ts
-var import_node_fs20 = require("node:fs");
-var import_node_os10 = require("node:os");
+var import_node_fs21 = require("node:fs");
+var import_node_os11 = require("node:os");
 var import_node_path18 = require("node:path");
 init_cli_shared();
 var WIN_NAMES = ["jerv-cli.cmd", "jerv-cli.exe", "jerv-cli"];
@@ -22293,7 +22817,7 @@ function normalizeSpawnPathEntry(entry, platform2 = process.platform) {
   if (msys) return `${msys[1].toUpperCase()}:\\${msys[2].replace(/\//g, "\\")}`;
   return trimmed;
 }
-function jervCliCandidateDirs(env = process.env, home = (0, import_node_os10.homedir)(), platform2 = process.platform) {
+function jervCliCandidateDirs(env = process.env, home = (0, import_node_os11.homedir)(), platform2 = process.platform) {
   const seen = /* @__PURE__ */ new Set();
   const out = [];
   const push = (dir) => {
@@ -22314,7 +22838,7 @@ function jervCliCandidateDirs(env = process.env, home = (0, import_node_os10.hom
   }
   return out;
 }
-function jervCliCandidatePaths(env = process.env, home = (0, import_node_os10.homedir)(), platform2 = process.platform) {
+function jervCliCandidatePaths(env = process.env, home = (0, import_node_os11.homedir)(), platform2 = process.platform) {
   const names = platform2 === "win32" ? WIN_NAMES : POSIX_NAMES;
   const out = [];
   for (const dir of jervCliCandidateDirs(env, home, platform2)) {
@@ -22322,20 +22846,20 @@ function jervCliCandidatePaths(env = process.env, home = (0, import_node_os10.ho
   }
   return out;
 }
-function resolveJervCliPath(env = process.env, home = (0, import_node_os10.homedir)(), platform2 = process.platform, exists = import_node_fs20.existsSync) {
+function resolveJervCliPath(env = process.env, home = (0, import_node_os11.homedir)(), platform2 = process.platform, exists = import_node_fs21.existsSync) {
   for (const candidate2 of jervCliCandidatePaths(env, home, platform2)) {
     if (exists(candidate2)) return candidate2;
   }
   return void 0;
 }
-function resolveJervCliNodeEntry(shimPath, exists = import_node_fs20.existsSync) {
+function resolveJervCliNodeEntry(shimPath, exists = import_node_fs21.existsSync) {
   const entry = (0, import_node_path18.join)((0, import_node_path18.dirname)(shimPath), JERV_CLI_ENTRY);
   return exists(entry) ? entry : void 0;
 }
 function jervCliExecFileArgs(args, opts = {}) {
   const platform2 = opts.platform ?? process.platform;
-  const exists = opts.exists ?? import_node_fs20.existsSync;
-  const resolved = resolveJervCliPath(opts.env ?? process.env, opts.home ?? (0, import_node_os10.homedir)(), platform2, exists);
+  const exists = opts.exists ?? import_node_fs21.existsSync;
+  const resolved = resolveJervCliPath(opts.env ?? process.env, opts.home ?? (0, import_node_os11.homedir)(), platform2, exists);
   if (resolved) {
     const entry = resolveJervCliNodeEntry(resolved, exists);
     if (entry) {
@@ -22425,7 +22949,7 @@ function globalNodeModulesRoots(host) {
   };
   const prefix = env.npm_config_prefix?.trim();
   if (prefix) push(platform2 === "win32" ? (0, import_node_path19.join)(prefix, "node_modules") : (0, import_node_path19.join)(prefix, "lib", "node_modules"));
-  for (const dir of jervCliCandidateDirs(env, host.home ?? (0, import_node_os11.homedir)(), platform2)) {
+  for (const dir of jervCliCandidateDirs(env, host.home ?? (0, import_node_os12.homedir)(), platform2)) {
     push((0, import_node_path19.join)(dir, "node_modules"));
     push((0, import_node_path19.join)((0, import_node_path19.dirname)(dir), "lib", "node_modules"));
   }
@@ -22434,16 +22958,16 @@ function globalNodeModulesRoots(host) {
 function readHead(path2) {
   let fd;
   try {
-    fd = (0, import_node_fs21.openSync)(path2, "r");
+    fd = (0, import_node_fs22.openSync)(path2, "r");
     const buffer = new Uint8Array(MAGIC_HEAD_BYTES);
-    const read = (0, import_node_fs21.readSync)(fd, buffer, 0, MAGIC_HEAD_BYTES, 0);
+    const read = (0, import_node_fs22.readSync)(fd, buffer, 0, MAGIC_HEAD_BYTES, 0);
     return buffer.subarray(0, read);
   } catch {
     return void 0;
   } finally {
     if (fd !== void 0) {
       try {
-        (0, import_node_fs21.closeSync)(fd);
+        (0, import_node_fs22.closeSync)(fd);
       } catch {
       }
     }
@@ -22451,7 +22975,7 @@ function readHead(path2) {
 }
 function fileBytes(path2) {
   try {
-    return (0, import_node_fs21.statSync)(path2).size;
+    return (0, import_node_fs22.statSync)(path2).size;
   } catch {
     return void 0;
   }
@@ -22465,13 +22989,13 @@ function readClaudeBinaryState(host = {}) {
   const arch = host.arch ?? process.arch;
   const magic = EXECUTABLE_MAGIC[platform2];
   if (!magic) return void 0;
-  const packageRoot = globalNodeModulesRoots(host).map((root) => (0, import_node_path19.join)(root, ...PACKAGE.split("/"))).find((dir) => (0, import_node_fs21.existsSync)((0, import_node_path19.join)(dir, "package.json")));
+  const packageRoot = globalNodeModulesRoots(host).map((root) => (0, import_node_path19.join)(root, ...PACKAGE.split("/"))).find((dir) => (0, import_node_fs22.existsSync)((0, import_node_path19.join)(dir, "package.json")));
   if (!packageRoot) return void 0;
   const keys = platformPackageKeys(platform2, arch);
   const fallbackPackage = `${PACKAGE}-${keys[0]}`;
   let manifest;
   try {
-    manifest = JSON.parse((0, import_node_fs21.readFileSync)((0, import_node_path19.join)(packageRoot, "package.json"), "utf8"));
+    manifest = JSON.parse((0, import_node_fs22.readFileSync)((0, import_node_path19.join)(packageRoot, "package.json"), "utf8"));
   } catch (e) {
     return {
       state: "unreadable",
@@ -22502,7 +23026,7 @@ function readClaudeBinaryState(host = {}) {
     (0, import_node_path19.join)(packageRoot, "node_modules", ...name.split("/"), binName),
     (0, import_node_path19.join)((0, import_node_path19.dirname)((0, import_node_path19.dirname)(packageRoot)), ...name.split("/"), binName)
   ];
-  const found = published.map((name) => ({ name, path: binIn(name).find((file) => (0, import_node_fs21.existsSync)(file)) })).find((c) => c.path);
+  const found = published.map((name) => ({ name, path: binIn(name).find((file) => (0, import_node_fs22.existsSync)(file)) })).find((c) => c.path);
   const platformPackage = found?.name ?? published[0];
   let source;
   let sourceProblem;
@@ -22513,7 +23037,7 @@ function readClaudeBinaryState(host = {}) {
   } else {
     source = { path: found.path, bytes: fileBytes(found.path) ?? 0 };
   }
-  if (!(0, import_node_fs21.existsSync)(binPath)) {
+  if (!(0, import_node_fs22.existsSync)(binPath)) {
     return { state: "missing", binPath, expectedMagic: magic.name, platformPackage, ...source ? { source } : {}, ...sourceProblem ? { sourceProblem } : {} };
   }
   const head = readHead(binPath);
@@ -22556,9 +23080,9 @@ function healClaudeBinary(host = {}, onStep) {
   const platform2 = host.platform ?? process.platform;
   const aside = `${probe.binPath}.stub-${Date.now()}`;
   let renamed = false;
-  if ((0, import_node_fs21.existsSync)(probe.binPath)) {
+  if ((0, import_node_fs22.existsSync)(probe.binPath)) {
     try {
-      (0, import_node_fs21.renameSync)(probe.binPath, aside);
+      (0, import_node_fs22.renameSync)(probe.binPath, aside);
       renamed = true;
       onStep?.(`renamed the stub aside: ${aside}`);
     } catch (e) {
@@ -22567,12 +23091,12 @@ function healClaudeBinary(host = {}, onStep) {
   }
   try {
     onStep?.(`copying ${probe.source.path} \u2192 ${probe.binPath} (${(probe.source.bytes / 1e6).toFixed(0)} MB)`);
-    (0, import_node_fs21.copyFileSync)(probe.source.path, probe.binPath);
-    if (platform2 !== "win32") (0, import_node_fs21.chmodSync)(probe.binPath, 493);
+    (0, import_node_fs22.copyFileSync)(probe.source.path, probe.binPath);
+    if (platform2 !== "win32") (0, import_node_fs22.chmodSync)(probe.binPath, 493);
   } catch (e) {
     if (renamed) {
       try {
-        (0, import_node_fs21.renameSync)(aside, probe.binPath);
+        (0, import_node_fs22.renameSync)(aside, probe.binPath);
       } catch {
         return { ok: false, detail: `copy failed (${e.message}) and the stub could not be restored \u2014 the original is at ${aside}` };
       }
@@ -22586,7 +23110,7 @@ function healClaudeBinary(host = {}, onStep) {
   let kept = false;
   if (renamed) {
     try {
-      (0, import_node_fs21.rmSync)(aside);
+      (0, import_node_fs22.rmSync)(aside);
     } catch {
       kept = true;
     }
@@ -22951,6 +23475,7 @@ function trainPlan(command, options = {}) {
         { label: "verify current branch is development", gated: true },
         { label: "verify registry META for this project", command: "mmi-cli oracle org project get <owner/repo>", gated: true },
         { label: "preflight required main secret names", command: "mmi-cli vault secrets preflight --stage main --repo <owner/repo>", gated: true },
+        { label: "preflight GitHub Actions hosted job start (billing/spending) before minting a tag", command: "train dispatches actions-job-start-canary.yml on MMI-Hub (#5604); exact-run --retry-publish skips this", gated: true },
         { label: "merge development to main", gated: true },
         { label: "fold the version bump into the release commit (Hub: full distribution set; app repos: root package manifest) \u2014 runs inside the apply step, no separate bump PR", gated: true },
         { label: "tag release and publish GitHub Release", gated: true },
@@ -22966,6 +23491,7 @@ function trainPlan(command, options = {}) {
         { label: "guard: refuse if origin/rc carries content not in development (a dev -> main release would drop it)", command: "git rev-list --count --right-only --cherry-pick --no-merges origin/development...origin/rc", gated: true },
         { label: "verify registry META for this project", command: "mmi-cli oracle org project get <owner/repo>", gated: true },
         { label: "preflight required main secret names", command: "mmi-cli vault secrets preflight --stage main --repo <owner/repo>", gated: true },
+        { label: "preflight GitHub Actions hosted job start (billing/spending) before minting a tag", command: "train dispatches actions-job-start-canary.yml on MMI-Hub (#5604); exact-run --retry-publish skips this", gated: true },
         { label: "merge development to main (rc skipped)", gated: true },
         { label: "fold the version bump into the release commit \u2014 runs inside the apply step, no separate bump PR", gated: true },
         { label: "tag release and publish GitHub Release", gated: true },
@@ -22980,6 +23506,7 @@ function trainPlan(command, options = {}) {
       { label: "verify current branch is rc", gated: true },
       { label: "verify registry META for this project", command: "mmi-cli oracle org project get <owner/repo>", gated: true },
       { label: "preflight required main secret names", command: "mmi-cli vault secrets preflight --stage main --repo <owner/repo>", gated: true },
+      { label: "preflight GitHub Actions hosted job start (billing/spending) before minting a tag", command: "train dispatches actions-job-start-canary.yml on MMI-Hub (#5604); exact-run --retry-publish skips this", gated: true },
       { label: "verify every main-only hotfix commit is covered by the rc candidate (the guard runs automatically inside the apply step below; --ack <sha> overrides a verified, trailer-less port)", command: "mmi-cli devops release --apply [--ack <sha>]", gated: true },
       { label: "merge rc to main", gated: true },
       { label: "fold the version bump into the release commit (app repos: root package manifest) \u2014 runs inside the apply step, no separate bump PR", gated: true },
@@ -23068,14 +23595,14 @@ function renderVerifyBroker(input) {
 
 // src/tenant-artifact.ts
 var import_node_crypto5 = require("node:crypto");
-var import_node_fs22 = require("node:fs");
+var import_node_fs23 = require("node:fs");
 var import_promises3 = require("node:fs/promises");
 var import_node_path20 = require("node:path");
 var ARTIFACT_ID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;
 var MAX_BYTES = 5 * 1024 * 1024 * 1024;
 async function sha256File(path2) {
   const hash = (0, import_node_crypto5.createHash)("sha256");
-  for await (const chunk of (0, import_node_fs22.createReadStream)(path2)) hash.update(chunk);
+  for await (const chunk of (0, import_node_fs23.createReadStream)(path2)) hash.update(chunk);
   return hash.digest("hex");
 }
 async function putTenantArtifact(repo, stage, inputPath, deps) {
@@ -23084,8 +23611,8 @@ async function putTenantArtifact(repo, stage, inputPath, deps) {
   const info = await (0, import_promises3.stat)(path2);
   if (!info.isFile()) throw new Error("tenant artifact put: input path must be a file");
   if (!Number.isSafeInteger(info.size) || info.size < 1 || info.size > MAX_BYTES) throw new Error(`tenant artifact put: file must be 1..${MAX_BYTES} bytes`);
-  const sha2563 = await sha256File(path2);
-  const prepared = await tenantArtifactUpload({ repo, stage, size: info.size, sha256: sha2563 }, deps);
+  const sha2564 = await sha256File(path2);
+  const prepared = await tenantArtifactUpload({ repo, stage, size: info.size, sha256: sha2564 }, deps);
   if (!prepared.ok) {
     const detail = prepared.body?.error ?? prepared.error ?? `HTTP ${prepared.status}`;
     throw new Error(`tenant artifact put: ${detail}`);
@@ -23098,7 +23625,7 @@ async function putTenantArtifact(repo, stage, inputPath, deps) {
     return [key, value];
   }));
   headers["content-length"] = String(info.size);
-  const stream = (0, import_node_fs22.createReadStream)(path2);
+  const stream = (0, import_node_fs23.createReadStream)(path2);
   let uploaded;
   try {
     uploaded = await fetch(body.uploadUrl, {
@@ -23113,8 +23640,8 @@ async function putTenantArtifact(repo, stage, inputPath, deps) {
     throw error;
   }
   if (!uploaded.ok) throw new Error(`tenant artifact put: object upload failed (HTTP ${uploaded.status})`);
-  if (body.size !== info.size || body.sha256 !== sha2563 || typeof body.expiresAt !== "string" || !Number.isFinite(Date.parse(body.expiresAt))) throw new Error("tenant artifact put: Hub returned inconsistent artifact metadata");
-  return { artifactId: body.artifactId, repo, stage, size: info.size, sha256: sha2563, expiresAt: body.expiresAt };
+  if (body.size !== info.size || body.sha256 !== sha2564 || typeof body.expiresAt !== "string" || !Number.isFinite(Date.parse(body.expiresAt))) throw new Error("tenant artifact put: Hub returned inconsistent artifact metadata");
+  return { artifactId: body.artifactId, repo, stage, size: info.size, sha256: sha2564, expiresAt: body.expiresAt };
 }
 
 // src/hotfix-coverage.ts
@@ -23300,7 +23827,7 @@ function clean3(out) {
   return out.trim();
 }
 function sleeper(deps) {
-  return deps.sleep ?? ((ms) => new Promise((resolve5) => setTimeout(resolve5, ms)));
+  return deps.sleep ?? ((ms) => new Promise((resolve6) => setTimeout(resolve6, ms)));
 }
 function normalizeHotfixVersion(input) {
   const m = /^v?(\d+\.\d+\.\d+)$/.exec(input.trim());
@@ -24295,7 +24822,7 @@ function renderDeployPortDoctor(report) {
 // src/repo-index.ts
 var import_node_crypto6 = require("node:crypto");
 var import_node_child_process12 = require("node:child_process");
-var import_node_fs23 = require("node:fs");
+var import_node_fs24 = require("node:fs");
 var import_node_path21 = require("node:path");
 
 // ../infra/repo-index-path-policy.mjs
@@ -24496,10 +25023,10 @@ function loadReadmeHints(cwd, candidatePaths) {
   for (const rel of readmes) {
     if (isHardDeniedPath(rel)) continue;
     const abs = (0, import_node_path21.join)(cwd, ...rel.split("/"));
-    if (!(0, import_node_fs23.existsSync)(abs)) continue;
+    if (!(0, import_node_fs24.existsSync)(abs)) continue;
     let text;
     try {
-      text = (0, import_node_fs23.readFileSync)(abs, "utf8");
+      text = (0, import_node_fs24.readFileSync)(abs, "utf8");
     } catch {
       continue;
     }
@@ -24535,10 +25062,10 @@ function rebuildRepoIndex(cwd, repoSlug3) {
     if (ignored.has(rel)) continue;
     if (isHardDeniedPath(rel)) continue;
     const abs = (0, import_node_path21.join)(cwd, ...rel.split("/"));
-    if (!(0, import_node_fs23.existsSync)(abs)) continue;
+    if (!(0, import_node_fs24.existsSync)(abs)) continue;
     let text;
     try {
-      text = (0, import_node_fs23.readFileSync)(abs, "utf8");
+      text = (0, import_node_fs24.readFileSync)(abs, "utf8");
     } catch {
       continue;
     }
@@ -24563,16 +25090,16 @@ function rebuildRepoIndex(cwd, repoSlug3) {
     entries
   };
   const store = repoIndexStorePath(cwd);
-  (0, import_node_fs23.mkdirSync)((0, import_node_path21.dirname)(store), { recursive: true });
-  (0, import_node_fs23.writeFileSync)(store, `${JSON.stringify(projection, null, 2)}
+  (0, import_node_fs24.mkdirSync)((0, import_node_path21.dirname)(store), { recursive: true });
+  (0, import_node_fs24.writeFileSync)(store, `${JSON.stringify(projection, null, 2)}
 `, "utf8");
   return projection;
 }
 function loadRepoIndex(cwd) {
   const store = repoIndexStorePath(cwd);
-  if (!(0, import_node_fs23.existsSync)(store)) return null;
+  if (!(0, import_node_fs24.existsSync)(store)) return null;
   try {
-    const raw = JSON.parse((0, import_node_fs23.readFileSync)(store, "utf8"));
+    const raw = JSON.parse((0, import_node_fs24.readFileSync)(store, "utf8"));
     if (raw?.schema !== REPO_INDEX_SCHEMA || !Array.isArray(raw.entries)) return null;
     return raw;
   } catch {
@@ -24656,8 +25183,8 @@ init_compat();
 // src/repo-index-v4/builder.ts
 var import_node_crypto9 = require("node:crypto");
 var import_node_child_process14 = require("node:child_process");
-var import_node_fs25 = require("node:fs");
-var import_node_os12 = require("node:os");
+var import_node_fs26 = require("node:fs");
+var import_node_os13 = require("node:os");
 var import_node_path23 = require("node:path");
 
 // ../infra/repo-index-material-buckets.mjs
@@ -24757,7 +25284,7 @@ function buildRepoIndexMaterialLayout(repo, chunks, embeddings) {
 
 // src/repo-index-v4/chunks.ts
 var import_node_crypto8 = require("node:crypto");
-var import_node_fs24 = require("node:fs");
+var import_node_fs25 = require("node:fs");
 var import_node_path22 = require("node:path");
 
 // src/repo-index-v4/language.ts
@@ -24923,10 +25450,10 @@ async function buildStructuralChunksForPaths(cwd, repo, commit, paths) {
   const chunks = [];
   for (const path2 of paths) {
     const absolute = (0, import_node_path22.join)(cwd, ...path2.split("/"));
-    if (!(0, import_node_fs24.existsSync)(absolute)) continue;
+    if (!(0, import_node_fs25.existsSync)(absolute)) continue;
     let source;
     try {
-      source = (0, import_node_fs24.readFileSync)(absolute, "utf8");
+      source = (0, import_node_fs25.readFileSync)(absolute, "utf8");
     } catch {
       continue;
     }
@@ -24988,7 +25515,8 @@ function planRepoIndexV4Delta(opts) {
   const baseCommit = opts.baseCommit ? opts.baseCommit.toLowerCase() : null;
   const full = (fallbackReason) => ({ mode: "full", headCommit, fallbackReason, ...baseCommit ? { baseCommit } : {} });
   if (opts.forceFull) return full("explicit-full-rebuild");
-  if (!baseCommit || !COMMIT.test(baseCommit) || baseCommit === headCommit) return full("no-active-authority");
+  if (!baseCommit || !COMMIT.test(baseCommit)) return full("no-active-authority");
+  if (baseCommit === headCommit) return { mode: "unchanged", baseCommit, headCommit };
   if (opts.basePipelineCompatible === false) return full("incompatible-base-provenance");
   if (opts.hasPriorMaterial === false) return full("no-prior-material");
   const { git: git3 } = opts;
@@ -25054,7 +25582,7 @@ function gitInfo(cwd) {
 }
 function prior(cwd) {
   try {
-    const p = JSON.parse((0, import_node_fs25.readFileSync)(statePath(cwd), "utf8"));
+    const p = JSON.parse((0, import_node_fs26.readFileSync)(statePath(cwd), "utf8"));
     return p?.schemaVersion === 4 && p?.manifest?.immutable === true ? p : null;
   } catch {
     return null;
@@ -25073,7 +25601,7 @@ function embeddingInput(cwd, chunk) {
 ${chunk.symbol ?? ""}
 ${chunk.blurb ?? ""}`;
   try {
-    const lines = (0, import_node_fs25.readFileSync)((0, import_node_path23.join)(cwd, ...chunk.path.split("/")), "utf8").split(/\r?\n/);
+    const lines = (0, import_node_fs26.readFileSync)((0, import_node_path23.join)(cwd, ...chunk.path.split("/")), "utf8").split(/\r?\n/);
     const body = lines.slice(Math.max(0, (c.startLine ?? 1) - 1), Math.min(lines.length, c.endLine ?? lines.length)).join("\n");
     return body.slice(0, 1e5);
   } catch {
@@ -25088,18 +25616,18 @@ function runEmbedderOnce(cwd, chunks, modelDirectory, createdAt) {
   if (!chunks.length) return { ok: true, embeddings: [] };
   const orchestratorRunner = (0, import_node_path23.join)(process.cwd(), "repo-indexer", "src", "batch.mjs");
   const targetRunner = (0, import_node_path23.join)(cwd, "repo-indexer", "src", "batch.mjs");
-  const file = (0, import_node_fs25.existsSync)(orchestratorRunner) ? orchestratorRunner : targetRunner;
-  if (!(0, import_node_fs25.existsSync)(file)) return { ok: false, reason: "embeddings-unavailable" };
+  const file = (0, import_node_fs26.existsSync)(orchestratorRunner) ? orchestratorRunner : targetRunner;
+  if (!(0, import_node_fs26.existsSync)(file)) return { ok: false, reason: "embeddings-unavailable" };
   const request = { texts: chunks.map((chunk) => ({ id: chunk.id, text: embeddingInput(cwd, chunk) })), maxBatch: V4_EMBED_BATCH };
   const env = { ...process.env, ...modelDirectory ? { MMI_REPO_INDEXER_MODEL_DIR: modelDirectory } : {} };
-  const requestDir = (0, import_node_fs25.mkdtempSync)((0, import_node_path23.join)((0, import_node_os12.tmpdir)(), "mmi-repo-index-req-"));
+  const requestDir = (0, import_node_fs26.mkdtempSync)((0, import_node_path23.join)((0, import_node_os13.tmpdir)(), "mmi-repo-index-req-"));
   const requestFile = (0, import_node_path23.join)(requestDir, "request.json");
-  (0, import_node_fs25.writeFileSync)(requestFile, JSON.stringify(request));
+  (0, import_node_fs26.writeFileSync)(requestFile, JSON.stringify(request));
   let result;
   try {
     result = (0, import_node_child_process14.spawnSync)(process.execPath, [file, requestFile], { encoding: "utf8", windowsHide: true, timeout: V4_EMBED_TIMEOUT_MS, maxBuffer: V4_MAX_ARTIFACT_BYTES, env });
   } finally {
-    (0, import_node_fs25.rmSync)(requestDir, { recursive: true, force: true });
+    (0, import_node_fs26.rmSync)(requestDir, { recursive: true, force: true });
   }
   if (result.error || result.status !== 0) {
     const cleanExit2 = result.error === void 0 && result.signal === void 0 && typeof result.status === "number" && result.status !== 0;
@@ -25232,8 +25760,8 @@ async function buildRepoIndexV4Detailed(cwd, repo, opts = {}) {
   const encoded = canonicalJson(envelope);
   if (Buffer.byteLength(encoded) > V4_MAX_ARTIFACT_BYTES) throw new Error(`repo-index v4 artifact exceeds ${V4_MAX_ARTIFACT_BYTES} byte ceiling`);
   const path2 = statePath(cwd);
-  (0, import_node_fs25.mkdirSync)((0, import_node_path23.dirname)(path2), { recursive: true });
-  (0, import_node_fs25.writeFileSync)(path2, `${JSON.stringify(envelope, null, 2)}
+  (0, import_node_fs26.mkdirSync)((0, import_node_path23.dirname)(path2), { recursive: true });
+  (0, import_node_fs26.writeFileSync)(path2, `${JSON.stringify(envelope, null, 2)}
 `, "utf8");
   const metrics = {
     mode: delta ? "delta" : "full",
@@ -25323,6 +25851,7 @@ function repoIndexV4BucketDigests(repo, chunks, embeddings) {
 
 // src/repo-index-cloud-client.ts
 var RETRY_ATTEMPTS2 = 3;
+var REPO_INDEX_GC_TIMEOUT_MS = 12e4;
 async function repoIndexSourceHostHeaders() {
   const { detectSurface: detectSurface2 } = await Promise.resolve().then(() => (init_plugin_guard_io(), plugin_guard_io_exports));
   return { [SOURCE_HOST_HEADER]: detectSurface2(process.env) };
@@ -25728,10 +26257,22 @@ async function statusRepoIndexCloud(repo, deps) {
     return { ok: false, error: e.message, code: "network" };
   }
 }
+function normalizeGcV4Repos(raw) {
+  if (!raw || typeof raw !== "object" || Array.isArray(raw)) return {};
+  const out = {};
+  for (const [repo, value] of Object.entries(raw)) {
+    if (!value || typeof value !== "object" || Array.isArray(value)) continue;
+    const removed = Array.isArray(value.removed) ? value.removed.filter((k) => typeof k === "string") : [];
+    const kept = Number(value.kept);
+    out[repo] = { removed, kept: Number.isFinite(kept) ? kept : 0 };
+  }
+  return out;
+}
 async function gcRepoIndexCloud(deps) {
   if (!deps.baseUrl) return { ok: false, error: "Hub API URL not configured" };
   const token = await deps.token();
   if (!token) return { ok: false, error: "no Hub session token (run `gh auth login`)" };
+  const timeoutMs = deps.timeoutMs ?? REPO_INDEX_GC_TIMEOUT_MS;
   try {
     const res = await fetchWithRetry(
       deps.fetch ?? fetch,
@@ -25741,19 +26282,38 @@ async function gcRepoIndexCloud(deps) {
         headers: { ...clientVersionHeaders(), Authorization: `Bearer ${token}`, "content-type": "application/json" },
         body: "{}"
       },
-      { attempts: RETRY_ATTEMPTS2, timeoutMs: deps.timeoutMs ?? REGISTRY_FETCH_TIMEOUT_MS, sleep: deps.retrySleep }
+      // Single attempt: GC tombstones authorities and deletes S3 objects. A timed-out POST may still
+      // finish on Hub; retrying would re-issue a destructive sweep without an authoritative receipt.
+      { attempts: 1, timeoutMs, sleep: deps.retrySleep }
     );
     const body = await res.json().catch(() => ({}));
     if (!res.ok) return { ok: false, error: body.error ?? `gc HTTP ${res.status}` };
-    return { ok: true, removed: body.removed ?? [] };
+    const removed = Array.isArray(body.removed) ? body.removed.filter((repo) => typeof repo === "string") : [];
+    const kept = Number(body.kept);
+    return {
+      ok: true,
+      removed,
+      kept: Number.isFinite(kept) ? kept : 0,
+      v4: {
+        dryRun: body.v4?.dryRun === true,
+        repos: normalizeGcV4Repos(body.v4?.repos)
+      }
+    };
   } catch (e) {
-    return { ok: false, error: e.message };
+    const msg = e.message || String(e);
+    if (/abort|timeout/i.test(msg)) {
+      return {
+        ok: false,
+        error: `repo-index gc timed out after ${timeoutMs}ms \u2014 Hub may still have completed the destructive sweep; run \`mmi-cli oracle repo-index status --cloud --json\` and verify before retrying`
+      };
+    }
+    return { ok: false, error: msg };
   }
 }
 
 // src/repo-index-sync.ts
-var import_node_fs27 = require("node:fs");
-var import_node_os13 = require("node:os");
+var import_node_fs28 = require("node:fs");
+var import_node_os14 = require("node:os");
 var import_node_path25 = require("node:path");
 var import_node_child_process15 = require("node:child_process");
 
@@ -25793,7 +26353,7 @@ function repoIndexRoster(projects) {
 }
 
 // src/repo-index-v4/edges.ts
-var import_node_fs26 = require("node:fs");
+var import_node_fs27 = require("node:fs");
 var import_node_path24 = require("node:path");
 var V4_GRAPH_MAX_EDGES = 5e3;
 var V4_GRAPH_MAX_EDGES_PER_FILE = 64;
@@ -25883,9 +26443,9 @@ function buildGraphEdges(cwd, repo, commit, rosterRepos2) {
   for (const path2 of paths) {
     if (ignored.has(path2) || isHardDeniedPath(path2) || !SUPPORTED.has(extension(path2))) continue;
     const absolute = (0, import_node_path24.join)(cwd, ...path2.split("/"));
-    if (!(0, import_node_fs26.existsSync)(absolute)) continue;
+    if (!(0, import_node_fs27.existsSync)(absolute)) continue;
     try {
-      edges.push(...graphEdgesForSource(repo, commit, path2, (0, import_node_fs26.readFileSync)(absolute, "utf8"), rosterRepos2));
+      edges.push(...graphEdgesForSource(repo, commit, path2, (0, import_node_fs27.readFileSync)(absolute, "utf8"), rosterRepos2));
     } catch {
     }
     if (edges.length >= V4_GRAPH_MAX_EDGES) break;
@@ -25894,6 +26454,16 @@ function buildGraphEdges(cwd, repo, commit, rosterRepos2) {
 }
 
 // src/repo-index-sync.ts
+function execFileUtf8(file, args) {
+  return new Promise((resolve6, reject) => {
+    (0, import_node_child_process15.execFile)(file, args, { encoding: "utf8", windowsHide: true }, (error, stdout) => {
+      if (error) reject(error);
+      else resolve6(String(stdout ?? ""));
+    });
+  });
+}
+var ESTATE_CLASSIFY_CONCURRENCY = 8;
+var ESTATE_HEALTHY_CLASSIFY_BUDGET_MS = 5 * 601e3;
 var COMMIT3 = /^[a-f0-9]{40}$/;
 var SHA256 = /^[a-f0-9]{64}$/;
 var UTC_MILLIS = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z$/;
@@ -25929,17 +26499,28 @@ function checkoutExactCommit(repo, dest, token, commit) {
   const head = git3(["rev-parse", "HEAD"]).trim().toLowerCase();
   if (head !== commit) throw new Error(`checkout of ${repo} resolved ${head}, not the requested commit ${commit}`);
 }
-function remoteHead(repo, token) {
+async function remoteHead(repo, token) {
   const basic = Buffer.from(`x-access-token:${token}`, "utf8").toString("base64");
-  const output = (0, import_node_child_process15.execFileSync)(
+  const stdout = await execFileUtf8(
     "git",
-    ["-c", `http.extraHeader=Authorization: Basic ${basic}`, "ls-remote", "--exit-code", `https://github.com/${repo}.git`, "HEAD"],
-    { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"], windowsHide: true }
+    ["-c", `http.extraHeader=Authorization: Basic ${basic}`, "ls-remote", "--exit-code", `https://github.com/${repo}.git`, "HEAD"]
   );
-  const match = String(output).match(/^([a-f0-9]{40})\s+HEAD$/m);
+  const match = stdout.match(/^([a-f0-9]{40})\s+HEAD$/m);
   if (!match) throw new Error(`could not resolve remote HEAD for ${repo}`);
   return match[1];
 }
+async function mapLimit(items, limit, fn) {
+  const out = new Array(items.length);
+  let next = 0;
+  const workers = Array.from({ length: Math.min(limit, items.length) }, async () => {
+    while (next < items.length) {
+      const i = next++;
+      out[i] = await fn(items[i], i);
+    }
+  });
+  await Promise.all(workers);
+  return out;
+}
 function verifiedReadyBase(statusValue, repo) {
   if (!statusValue || typeof statusValue !== "object" || Array.isArray(statusValue)) return null;
   const status = statusValue;
@@ -26041,11 +26622,18 @@ async function syncEstateRepoIndex(opts) {
   const busy = new Set(
     (opts.skipRepos ?? []).map((repo) => normalizeRepoIndexRepo(repo)).filter((repo) => repo !== null)
   );
-  for (const repo of repos) {
+  const emit = (progress) => {
+    try {
+      opts.onClassify?.(progress);
+    } catch {
+    }
+  };
+  const classified = await mapLimit(repos, ESTATE_CLASSIFY_CONCURRENCY, async (repo) => {
     if (busy.has(repo)) {
-      drift.push({ repo, reason: "busy-elsewhere", action: "skip" });
-      skipped.push(`${repo}: a per-repo reconcile run is already publishing it`);
-      continue;
+      const row2 = { repo, reason: "busy-elsewhere", action: "skip" };
+      const warning = `${repo}: a per-repo reconcile run is already publishing it`;
+      emit({ row: row2, warning });
+      return { repo, row: row2, warning, base: null, expectedActiveDigest: void 0 };
     }
     let base = null;
     let expectedActiveDigest;
@@ -26066,43 +26654,72 @@ async function syncEstateRepoIndex(opts) {
     }
     let targetCommit = requestedCommit || void 0;
     if (base && !forceFull) {
+      let headUnreadable = false;
       if (!targetCommit) {
         try {
-          targetCommit = remoteHead(repo, opts.githubToken);
+          targetCommit = await remoteHead(repo, opts.githubToken);
         } catch {
-          targetCommit = void 0;
+          headUnreadable = true;
         }
       }
       const provenance = await fetchRepoIndexV4ProvenanceCloud(repo, opts.deps).catch(
         (error) => ({ ok: false, error: error.message })
       );
       if (provenance.ok && !provenance.deltaCompatible) {
-        drift.push({ repo, reason: "incompatible-provenance", action: "needs-full-rebuild", activeCommit: base.commit, ...targetCommit ? { targetCommit } : {} });
-        needsFullRebuild.push(repo);
-        skipped.push(`${repo}: DRIFT incompatible index provenance \u2014 the active authority at ${base.commit} was not built by ${CURRENT_REPO_INDEX_PROVENANCE_TOKEN}; migrate it explicitly with \`oracle repo-index sync-estate --repo ${repo} --full-rebuild ${CURRENT_REPO_INDEX_PROVENANCE_TOKEN}\``);
-        continue;
+        const row2 = {
+          repo,
+          reason: "incompatible-provenance",
+          action: "needs-full-rebuild",
+          activeCommit: base.commit,
+          ...targetCommit ? { targetCommit } : {}
+        };
+        const warning = `${repo}: DRIFT incompatible index provenance \u2014 the active authority at ${base.commit} was not built by ${CURRENT_REPO_INDEX_PROVENANCE_TOKEN}; migrate it explicitly with \`oracle repo-index sync-estate --repo ${repo} --full-rebuild ${CURRENT_REPO_INDEX_PROVENANCE_TOKEN}\``;
+        emit({ row: row2, warning });
+        return { repo, row: row2, warning, base, expectedActiveDigest };
       }
       if (targetCommit && targetCommit === base.commit) {
-        drift.push({ repo, reason: "healthy", action: "skip", activeCommit: base.commit, targetCommit });
-        skipped.push(`${repo}: unchanged verified-ready authority at ${targetCommit}`);
-        continue;
+        const row2 = { repo, reason: "healthy", action: "skip", activeCommit: base.commit, targetCommit };
+        const warning = `${repo}: unchanged verified-ready authority at ${targetCommit}`;
+        emit({ row: row2, warning });
+        return { repo, row: row2, warning, base, expectedActiveDigest };
+      }
+      if (headUnreadable) {
+        const row2 = { repo, reason: "head-unreadable", action: "skip", activeCommit: base.commit };
+        const warning = `${repo}: remote HEAD unreadable; leaving verified-ready authority at ${base.commit}`;
+        emit({ row: row2, warning });
+        return { repo, row: row2, warning, base, expectedActiveDigest };
       }
     }
-    drift.push({
+    const row = {
       repo,
       reason,
       action: "build",
       ...base ? { activeCommit: base.commit } : {},
       ...targetCommit ? { targetCommit } : {}
-    });
-    if (opts.plan) continue;
-    const dir = (0, import_node_fs27.mkdtempSync)((0, import_node_path25.join)((0, import_node_os13.tmpdir)(), "mmi-repo-index-"));
+    };
+    emit({ row });
+    return { repo, row, base, expectedActiveDigest };
+  });
+  for (const entry of classified) {
+    drift.push(entry.row);
+    if (entry.warning) skipped.push(entry.warning);
+    if (entry.row.action === "needs-full-rebuild") needsFullRebuild.push(entry.repo);
+  }
+  if (opts.plan) return answer();
+  for (const entry of classified) {
+    if (entry.row.action !== "build") continue;
+    const { repo, base, expectedActiveDigest } = entry;
+    const dir = (0, import_node_fs28.mkdtempSync)((0, import_node_path25.join)((0, import_node_os14.tmpdir)(), "mmi-repo-index-"));
     try {
       shallowClone(repo, dir, opts.githubToken);
       if (requestedCommit) checkoutExactCommit(repo, dir, opts.githubToken, requestedCommit);
       let v4;
       try {
         const plan = await planDeltaBuild(repo, dir, base, opts.deps, opts.githubToken, forceFull);
+        if (plan.plan.mode === "unchanged") {
+          skipped.push(`${repo}: unchanged verified-ready authority at ${plan.plan.headCommit}`);
+          continue;
+        }
         if (base && plan.plan.mode === "full") skipped.push(`${repo}: full rebuild (${plan.plan.fallbackReason})`);
         v4 = await buildRepoIndexV4Detailed(dir, repo, {
           modelDirectory: process.env.MMI_REPO_INDEXER_MODEL_DIR,
@@ -26146,7 +26763,7 @@ async function syncEstateRepoIndex(opts) {
       failed.push({ repo, error: e.message });
     } finally {
       try {
-        (0, import_node_fs27.rmSync)(dir, { recursive: true, force: true });
+        (0, import_node_fs28.rmSync)(dir, { recursive: true, force: true });
       } catch {
       }
     }
@@ -26155,7 +26772,7 @@ async function syncEstateRepoIndex(opts) {
 }
 
 // src/repo-index-health.ts
-var import_node_fs28 = require("node:fs");
+var import_node_fs29 = require("node:fs");
 
 // testdata/repo-index-golden-queries.json
 var repo_index_golden_queries_default = {
@@ -26259,7 +26876,7 @@ function assertGoldenSuite(raw, source) {
 function loadGoldenSuite(path2) {
   let text;
   try {
-    text = (0, import_node_fs28.readFileSync)(path2, "utf8");
+    text = (0, import_node_fs29.readFileSync)(path2, "utf8");
   } catch (e) {
     throw new Error(`golden suite unreadable at ${path2}: ${e.message}`);
   }
@@ -26429,7 +27046,7 @@ async function runRepoIndexHealth(opts) {
 
 // src/spawn-policy-core.ts
 var import_node_child_process16 = require("node:child_process");
-var import_node_fs29 = require("node:fs");
+var import_node_fs30 = require("node:fs");
 var import_node_path26 = require("node:path");
 var SPAWNERS = ["spawn", "spawnSync", "exec", "execSync", "execFile", "execFileSync"];
 var CALL_SOURCE = String.raw`(^|[^.\w$])(${SPAWNERS.join("|")})\s*\(`;
@@ -26516,7 +27133,7 @@ function runSpawnPolicy(root) {
   for (const file of files) {
     let raw;
     try {
-      raw = (0, import_node_fs29.readFileSync)((0, import_node_path26.join)(root, file), "utf8");
+      raw = (0, import_node_fs30.readFileSync)((0, import_node_path26.join)(root, file), "utf8");
     } catch {
       continue;
     }
@@ -26534,8 +27151,81 @@ function runSpawnPolicy(root) {
 
 // src/test-policy-core.ts
 var import_node_child_process17 = require("node:child_process");
-var import_node_fs30 = require("node:fs");
+var import_node_fs31 = require("node:fs");
 var import_node_path27 = require("node:path");
+
+// ../scripts/test-command-policy-core.mjs
+var TEST_COMMAND_CLASS = "test";
+function translateGlob(glob) {
+  let out = "";
+  for (let i = 0; i < glob.length; i += 1) {
+    const char = glob[i];
+    if (char === "*") {
+      if (glob[i + 1] === "*") {
+        if (glob[i + 2] === "/") {
+          out += "(?:.*/)?";
+          i += 2;
+        } else {
+          out += ".*";
+          i += 1;
+        }
+      } else out += "[^/]*";
+    } else if (char === "{") {
+      const close = glob.indexOf("}", i);
+      if (close === -1) out += "\\{";
+      else {
+        out += `(?:${glob.slice(i + 1, close).split(",").map(translateGlob).join("|")})`;
+        i = close;
+      }
+    } else {
+      out += /[.+?^${}()|[\]\\]/.test(char) ? `\\${char}` : char;
+    }
+  }
+  return out;
+}
+function globToRegExp(glob) {
+  return new RegExp(`^${translateGlob(glob)}$`);
+}
+function mandatoryGlobList(mandatory) {
+  if (!Array.isArray(mandatory)) return [];
+  return mandatory.map((entry) => typeof entry === "string" ? entry : entry?.glob).filter((glob) => typeof glob === "string");
+}
+function matchedMandatoryGlobs(paths, mandatory) {
+  const globs = mandatoryGlobList(mandatory);
+  const list = Array.isArray(paths) ? paths : [];
+  return globs.filter((glob) => {
+    const re = globToRegExp(glob);
+    return list.some((path2) => re.test(path2));
+  });
+}
+function evaluateTestCommandPolicy({ paths, mandatory, regulated = true } = {}) {
+  const configuredMandatoryCount = mandatoryGlobList(mandatory).length;
+  if (!regulated) {
+    return {
+      configuredMandatoryCount: 0,
+      matchedMandatoryGlobs: [],
+      matchedMandatoryCount: 0,
+      testCommandsAllowed: true,
+      reasonId: null,
+      commandClasses: { allowed: [TEST_COMMAND_CLASS], refused: [] }
+    };
+  }
+  const matched = matchedMandatoryGlobs(paths, mandatory);
+  const testCommandsAllowed = matched.length > 0;
+  return {
+    configuredMandatoryCount,
+    matchedMandatoryGlobs: matched,
+    matchedMandatoryCount: matched.length,
+    testCommandsAllowed,
+    reasonId: testCommandsAllowed ? null : "test-command-outside-mandatory-zone",
+    commandClasses: {
+      allowed: testCommandsAllowed ? [TEST_COMMAND_CLASS] : [],
+      refused: testCommandsAllowed ? [] : [TEST_COMMAND_CLASS]
+    }
+  };
+}
+
+// src/test-policy-core.ts
 var POLICY_FILE = "test-policy.json";
 var TEST_RE = /\.(?:test|spec)\.[cm]?[jt]sx?$/;
 var PY_TEST_RE = /(?:^|\/)test_[^/]*\.py$|_test\.py$/;
@@ -26581,7 +27271,7 @@ function translate(glob) {
   }
   return out;
 }
-function globToRegExp(glob) {
+function globToRegExp2(glob) {
   return new RegExp(`^${translate(glob)}$`);
 }
 function isTestPath(path2) {
@@ -26815,7 +27505,7 @@ function isMeaningfulChange(path2, before, after) {
   return !a.every((t, k) => t.text === b[k].text && t.nl === b[k].nl);
 }
 function annotateChangeMeaning(changed, policy, read) {
-  const matchers = (policy.mandatory ?? []).map((m) => globToRegExp(m.glob));
+  const matchers = (policy.mandatory ?? []).map((m) => globToRegExp2(m.glob));
   return changed.map((file) => {
     if (file.status !== "M" || !SUPPORTED_SOURCE.test(file.path)) return file;
     if (!matchers.some((re) => re.test(file.path)) && !isTestPath(file.path)) return file;
@@ -26842,7 +27532,7 @@ function loadPolicy(root, readFile7 = readFileOrNull2) {
 }
 function readFileOrNull2(path2) {
   try {
-    return (0, import_node_fs30.readFileSync)(path2, "utf8");
+    return (0, import_node_fs31.readFileSync)(path2, "utf8");
   } catch {
     return null;
   }
@@ -26853,7 +27543,7 @@ function removedPaths2(changed) {
   );
 }
 function classify(changed, policy, present = () => false) {
-  const matchers = (policy.mandatory ?? []).map((m) => ({ ...m, re: globToRegExp(m.glob) }));
+  const matchers = (policy.mandatory ?? []).map((m) => ({ ...m, re: globToRegExp2(m.glob) }));
   const mandatoryHits = changed.filter((f) => matchers.some((m) => m.re.test(f.path)));
   const testChanges = changed.filter((f) => isTestPath(f.path));
   const addedTests = testChanges.filter((f) => f.status === "A");
@@ -26870,10 +27560,10 @@ function classify(changed, policy, present = () => false) {
   const removedProtected = [...removed].filter((p) => protectedBy.has(p)).map((p) => ({ path: p, why: protectedBy.get(p) ?? "" }));
   return { mandatoryHits, untestedHits, testChanges, meaningfulTestChanges, addedTests, removedProtected };
 }
-function unresolvedProtectedEntries(policy, root, exists = (path2) => (0, import_node_fs30.existsSync)(path2)) {
+function unresolvedProtectedEntries(policy, root, exists = (path2) => (0, import_node_fs31.existsSync)(path2)) {
   return (policy.protected ?? []).map((p) => p.path).filter((p) => !exists((0, import_node_path27.join)(root, p)));
 }
-function unresolvedSatisfiers(policy, root, exists = (path2) => (0, import_node_fs30.existsSync)(path2)) {
+function unresolvedSatisfiers(policy, root, exists = (path2) => (0, import_node_fs31.existsSync)(path2)) {
   const declared = (policy.mandatory ?? []).flatMap((m) => m.satisfiedBy ?? []);
   return [...new Set(declared)].filter((p) => !exists((0, import_node_path27.join)(root, p)));
 }
@@ -27064,7 +27754,7 @@ function blobAt(base, path2, cwd) {
 }
 function runTestPolicy(root, deps = {}) {
   const policy = deps.policy ?? loadPolicy(root);
-  const exists = deps.exists ?? ((path2) => (0, import_node_fs30.existsSync)(path2));
+  const exists = deps.exists ?? ((path2) => (0, import_node_fs31.existsSync)(path2));
   const counts = { mandatoryCount: (policy.mandatory ?? []).length, protectedCount: (policy.protected ?? []).length };
   const base = deps.changed ? "(injected)" : resolveBase(root, deps.base);
   const refusal = deps.changed ? null : untrustworthyRange(root, base);
@@ -27103,7 +27793,23 @@ function runTestPolicy(root, deps = {}) {
   };
   const blocking = sift([...refusal ? [refusal] : [], ...lookup.refusals, ...staleFindings]);
   const findings = blocking.length > 0 ? blocking : sift(evaluate(changed, policy, present));
-  const result = { ok: findings.length === 0, findings, changedCount: changed.length, base, ...counts };
+  const commandPolicy = evaluateTestCommandPolicy({
+    paths: changed.map((f) => f.path),
+    mandatory: policy.mandatory,
+    regulated: policy.declared !== false
+  });
+  const result = {
+    ok: findings.length === 0,
+    findings,
+    changedCount: changed.length,
+    base,
+    ...counts,
+    matchedMandatoryGlobs: commandPolicy.matchedMandatoryGlobs,
+    matchedMandatoryCount: commandPolicy.matchedMandatoryCount,
+    testCommandsAllowed: commandPolicy.testCommandsAllowed,
+    testCommandReasonId: commandPolicy.reasonId,
+    commandClasses: commandPolicy.commandClasses
+  };
   if (override) {
     result.overriddenBy = override;
     result.waived = waived;
@@ -27111,9 +27817,197 @@ function runTestPolicy(root, deps = {}) {
   return result;
 }
 
-// src/project-info-sync.ts
-var import_node_fs31 = require("node:fs");
+// src/dist-drift.ts
+var import_node_child_process18 = require("node:child_process");
+var import_node_crypto12 = require("node:crypto");
+var import_node_fs33 = require("node:fs");
+var import_node_os15 = require("node:os");
+var import_node_path29 = require("node:path");
+
+// ../scripts/distribution-digest.mjs
+var import_node_crypto11 = require("node:crypto");
+var import_node_fs32 = require("node:fs");
 var import_node_path28 = require("node:path");
+var slash = (value) => value.replaceAll("\\", "/");
+function repoPath(root, declaredPath, label) {
+  const absoluteRoot = (0, import_node_path28.resolve)(root);
+  const target = (0, import_node_path28.resolve)(root, declaredPath);
+  if (target !== absoluteRoot && !target.startsWith(`${absoluteRoot}${import_node_path28.sep}`)) {
+    throw new Error(`${label} ${declaredPath} escapes the repository root`);
+  }
+  return target;
+}
+function digestFiles(files) {
+  const hash = (0, import_node_crypto11.createHash)("sha256");
+  for (const file of [...files].sort((a, b) => a.relative.localeCompare(b.relative))) {
+    const content = file.stat.isSymbolicLink() ? Buffer.from((0, import_node_fs32.readlinkSync)(file.absolute), "utf8") : (0, import_node_fs32.readFileSync)(file.absolute);
+    hash.update(file.relative, "utf8");
+    hash.update("\0");
+    hash.update(file.stat.isSymbolicLink() ? "symlink" : "file", "utf8");
+    hash.update("\0");
+    hash.update(String(content.length), "utf8");
+    hash.update("\0");
+    hash.update(content);
+    hash.update("\0");
+  }
+  return `sha256:${hash.digest("hex")}`;
+}
+function digestPackedFiles(packageRoot, packedFiles) {
+  return digestFiles(packedFiles.map((path2) => {
+    const absolute = repoPath(packageRoot, path2, "packed artifact identity path");
+    if (!(0, import_node_fs32.existsSync)(absolute)) throw new Error(`packed artifact identity path ${path2} does not exist`);
+    return { absolute, relative: slash(path2), stat: (0, import_node_fs32.lstatSync)(absolute) };
+  }));
+}
+
+// src/dist-drift.ts
+var DIST_ARTIFACTS = [
+  { path: "cli/dist/index.cjs", packageDir: "cli", output: "index.cjs" },
+  { path: "cli/dist/main.cjs", packageDir: "cli", output: "main.cjs" },
+  { path: "cli/dist/repo-index-v4.cjs", packageDir: "cli", output: "repo-index-v4.cjs" },
+  { path: "updater/dist/index.cjs", packageDir: "updater", output: "index.cjs" }
+];
+var BOM_DIST_TREE_ID = "mmi-cli-dist";
+var ABSENT = "absent";
+var sha2563 = (bytes) => `sha256:${(0, import_node_crypto12.createHash)("sha256").update(bytes).digest("hex")}`;
+function artifactDrift(path2, committedBytes, rebuiltBytes) {
+  const committed = committedBytes ? sha2563(committedBytes) : ABSENT;
+  const rebuiltExpected = rebuiltBytes ? sha2563(rebuiltBytes) : ABSENT;
+  return { path: path2, status: committed === rebuiltExpected ? "current" : "stale", committed, rebuiltExpected };
+}
+function distTreeIdentity(labels, rebuilt, committed, digest) {
+  const entries = [];
+  for (const label of labels) {
+    const bytes = rebuilt(label) ?? committed(label);
+    if (!bytes) {
+      return { rebuiltExpected: ABSENT, note: `recorded tree file ${label} is absent from the checkout` };
+    }
+    entries.push({ path: label, bytes });
+  }
+  return { rebuiltExpected: digest(entries) };
+}
+function npmPackIdentity(id, packageDir, identity, rebuilt, tree, digest) {
+  const recorded = identity?.value ?? ABSENT;
+  const kind = identity?.kind ?? "npm-pack";
+  if (!identity || !Array.isArray(identity.files) || identity.files.length === 0) {
+    return { id, kind, status: "stale", recorded, rebuiltExpected: ABSENT, note: "identity records no packed file list to recompute against" };
+  }
+  const entries = [];
+  for (const label of identity.files) {
+    const repoPath2 = `${packageDir}/${label}`;
+    const bytes = label.startsWith("dist/") ? rebuilt(repoPath2) : tree(repoPath2);
+    if (!bytes) {
+      return { id, kind, status: "stale", recorded, rebuiltExpected: ABSENT, note: `packed file ${repoPath2} is absent from the checkout` };
+    }
+    entries.push({ path: label, bytes });
+  }
+  const rebuiltExpected = digest(entries);
+  return { id, kind, status: recorded === rebuiltExpected ? "current" : "stale", recorded, rebuiltExpected };
+}
+function computeDistDriftReceipt(sources) {
+  const artifacts = DIST_ARTIFACTS.map((spec) => artifactDrift(spec.path, sources.committed(spec.path), sources.rebuilt(spec.path)));
+  const bomArtifact = (id) => sources.bom.artifacts?.find((entry) => entry.id === id);
+  const cliDistDeclared = bomArtifact(BOM_DIST_TREE_ID)?.identity;
+  const distTree = distTreeIdentity(sources.distTree(), sources.rebuilt, sources.committed, sources.digest);
+  const distTreeRecorded = cliDistDeclared?.value ?? ABSENT;
+  const identities = [
+    { id: BOM_DIST_TREE_ID, kind: cliDistDeclared?.kind ?? "sha256-tree", status: distTreeRecorded === distTree.rebuiltExpected ? "current" : "stale", recorded: distTreeRecorded, rebuiltExpected: distTree.rebuiltExpected, ...distTree.note ? { note: distTree.note } : {} },
+    npmPackIdentity("mmi-cli", "cli", bomArtifact("mmi-cli")?.identity, sources.rebuilt, sources.tree, sources.digest),
+    npmPackIdentity("mmi-hub", "updater", bomArtifact("mmi-hub")?.identity, sources.rebuilt, sources.tree, sources.digest)
+  ];
+  const representative = identities[0];
+  const bomStatus = identities.some((identity) => identity.status === "stale") ? "stale" : "current";
+  const staleCount = artifacts.filter((a) => a.status === "stale").length + (bomStatus === "stale" ? 1 : 0);
+  const summary = staleCount > 0 ? `dist/BOM: ${staleCount} artifact(s) stale \u2014 refresh with \`node scripts/release-distribution.mjs prepare\`` : "dist/BOM: current \u2014 committed dist and distribution-bom.json match a fresh rebuild of source";
+  return {
+    artifacts,
+    bom: { status: bomStatus, recorded: representative.recorded, rebuiltExpected: representative.rebuiltExpected, identities },
+    staleCount,
+    summary
+  };
+}
+function shortHash(value) {
+  return value.startsWith("sha256:") ? `sha256:${value.slice(7, 23)}` : value;
+}
+function renderDistDriftReceipt(receipt) {
+  const lines = [];
+  for (const artifact of receipt.artifacts) {
+    lines.push(`${artifact.path}  ${artifact.status}  committed=${shortHash(artifact.committed)}  rebuilt-expected=${shortHash(artifact.rebuiltExpected)}`);
+  }
+  const line = `distribution-bom.json  ${receipt.bom.status}  committed=${shortHash(receipt.bom.recorded)}  rebuilt-expected=${shortHash(receipt.bom.rebuiltExpected)}`;
+  const otherStale = receipt.bom.identities.filter((identity) => identity.id !== BOM_DIST_TREE_ID && identity.status === "stale");
+  lines.push(otherStale.length > 0 ? `${line}  (${otherStale.map((identity) => `${identity.id} identity stale`).join("; ")})` : line);
+  lines.push(receipt.summary);
+  return lines;
+}
+function readOrNull(path2) {
+  return (0, import_node_fs33.existsSync)(path2) ? (0, import_node_fs33.readFileSync)(path2) : null;
+}
+function walkFiles(root) {
+  const files = [];
+  const walk2 = (directory) => {
+    for (const entry of (0, import_node_fs33.readdirSync)(directory, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name))) {
+      const child2 = (0, import_node_path29.join)(directory, entry.name);
+      if (entry.isDirectory()) walk2(child2);
+      else files.push(child2);
+    }
+  };
+  walk2(root);
+  return files;
+}
+function bomPathFor(root) {
+  try {
+    const registry2 = JSON.parse((0, import_node_fs33.readFileSync)((0, import_node_path29.join)(root, "surfaces.json"), "utf8"));
+    return (0, import_node_path29.join)(root, registry2?.sharedAgentCore?.releaseMetadata?.bomPath ?? "distribution-bom.json");
+  } catch {
+    return (0, import_node_path29.join)(root, "distribution-bom.json");
+  }
+}
+function rebuildTo(packageRoot, outDir) {
+  (0, import_node_child_process18.execFileSync)(process.execPath, ["build.mjs"], {
+    cwd: packageRoot,
+    env: { ...process.env, MMI_DIST_OUTDIR: outDir },
+    windowsHide: true,
+    stdio: "pipe",
+    encoding: "utf8"
+  });
+}
+function runDistStatus(root) {
+  const stage = (0, import_node_fs33.mkdtempSync)((0, import_node_path29.join)((0, import_node_os15.tmpdir)(), "mmi-dist-drift-"));
+  let overlayCount = 0;
+  try {
+    const cliOut = (0, import_node_path29.join)(stage, "cli-dist");
+    const hubOut = (0, import_node_path29.join)(stage, "hub-dist");
+    rebuildTo((0, import_node_path29.join)(root, "cli"), cliOut);
+    rebuildTo((0, import_node_path29.join)(root, "updater"), hubOut);
+    const outDirFor = (packageDir) => packageDir === "cli" ? cliOut : hubOut;
+    const rebuilt = (path2) => {
+      const spec = DIST_ARTIFACTS.find((entry) => entry.path === path2);
+      return spec ? readOrNull((0, import_node_path29.join)(outDirFor(spec.packageDir), spec.output)) : null;
+    };
+    const committed = (path2) => readOrNull((0, import_node_path29.join)(root, path2));
+    const tree = (path2) => readOrNull((0, import_node_path29.join)(root, path2));
+    const distRoot = (0, import_node_path29.join)(root, "cli", "dist");
+    const distTree = () => walkFiles(distRoot).map((absolute) => `cli/dist/${(0, import_node_path29.relative)(distRoot, absolute).replaceAll("\\", "/")}`);
+    const bom = JSON.parse((0, import_node_fs33.readFileSync)(bomPathFor(root), "utf8"));
+    const digest = (entries) => {
+      const overlay = (0, import_node_path29.join)(stage, `overlay-${overlayCount++}`);
+      for (const entry of entries) {
+        const target = (0, import_node_path29.join)(overlay, entry.path);
+        (0, import_node_fs33.mkdirSync)((0, import_node_path29.dirname)(target), { recursive: true });
+        (0, import_node_fs33.writeFileSync)(target, entry.bytes);
+      }
+      return digestPackedFiles(overlay, entries.map((entry) => entry.path));
+    };
+    return computeDistDriftReceipt({ committed, tree, rebuilt, distTree, bom, digest });
+  } finally {
+    (0, import_node_fs33.rmSync)(stage, { recursive: true, force: true });
+  }
+}
+
+// src/project-info-sync.ts
+var import_node_fs34 = require("node:fs");
+var import_node_path30 = require("node:path");
 var UPDATE_PROJECT_INFO = `mutation($projectId: ID!, $shortDescription: String!, $readme: String!) {
   updateProjectV2(input: { projectId: $projectId, shortDescription: $shortDescription, readme: $readme }) {
     projectV2 { id }
@@ -27158,14 +28052,14 @@ function sharedName(entries, fallback) {
 }
 function buildProjectInfoSyncPlan(targetRepo3, project2, projects, repoRoot2) {
   if (!project2.projectId) throw new Error(`org project sync-info: ${targetRepo3} registry META has no projectId`);
-  const readmePath = (0, import_node_path28.join)(repoRoot2, "README.md");
-  if (!(0, import_node_fs31.existsSync)(readmePath)) throw new Error(`org project sync-info: ${targetRepo3} has no README.md`);
+  const readmePath = (0, import_node_path30.join)(repoRoot2, "README.md");
+  if (!(0, import_node_fs34.existsSync)(readmePath)) throw new Error(`org project sync-info: ${targetRepo3} has no README.md`);
   const entries = entriesFor(project2, projects);
   const memberRepos = [...new Set(entries.flatMap((entry) => entry.repos ?? []))].filter((repo) => /^[^/]+\/[^/]+$/.test(repo)).sort((a, b) => a.localeCompare(b));
   const projectName = sharedName(entries, project2.name?.trim() || targetRepo3.split("/").pop() || targetRepo3);
   if (!memberRepos.length) throw new Error(`org project sync-info: project ${projectName} has no registered member repos`);
   const entryNames = entries.map((entry) => entry.name?.trim()).filter((name) => Boolean(name));
-  const shortDescription = memberRepos.length === 1 ? shortDescriptionFromReadme((0, import_node_fs31.readFileSync)(readmePath, "utf8")) : `Shared work across ${new Intl.ListFormat("en", { type: "conjunction" }).format(entryNames)}.`;
+  const shortDescription = memberRepos.length === 1 ? shortDescriptionFromReadme((0, import_node_fs34.readFileSync)(readmePath, "utf8")) : `Shared work across ${new Intl.ListFormat("en", { type: "conjunction" }).format(entryNames)}.`;
   const lines = [
     `# ${projectName}`,
     "",
@@ -27184,8 +28078,8 @@ function buildProjectInfoSyncPlan(targetRepo3, project2, projects, repoRoot2) {
   const targetBase = `https://github.com/${targetRepo3}`;
   const targetBranch = branchFor(targetRepo3, projects);
   const orgDocs = [
-    (0, import_node_fs31.existsSync)((0, import_node_path28.join)(repoRoot2, "docs", "org-readme.md")) ? `- [Org identity](${targetBase}/blob/${targetBranch}/docs/org-readme.md)` : "",
-    (0, import_node_fs31.existsSync)((0, import_node_path28.join)(repoRoot2, "docs", "org-architecture.md")) ? `- [Org architecture](${targetBase}/blob/${targetBranch}/docs/org-architecture.md)` : ""
+    (0, import_node_fs34.existsSync)((0, import_node_path30.join)(repoRoot2, "docs", "org-readme.md")) ? `- [Org identity](${targetBase}/blob/${targetBranch}/docs/org-readme.md)` : "",
+    (0, import_node_fs34.existsSync)((0, import_node_path30.join)(repoRoot2, "docs", "org-architecture.md")) ? `- [Org architecture](${targetBase}/blob/${targetBranch}/docs/org-architecture.md)` : ""
   ].filter(Boolean);
   if (orgDocs.length) lines.push("", "## Organisation docs", "", ...orgDocs);
   return { projectId: project2.projectId, projectName, targetRepo: targetRepo3, memberRepos, shortDescription, readme: `${lines.join("\n")}
@@ -28033,9 +28927,9 @@ function writeError(res) {
 }
 
 // src/secrets-commands.ts
-var import_node_fs32 = require("node:fs");
-var import_node_path29 = require("node:path");
-var import_node_os14 = require("node:os");
+var import_node_fs35 = require("node:fs");
+var import_node_path31 = require("node:path");
+var import_node_os16 = require("node:os");
 init_cli_shared();
 init_hub_auth();
 init_github_client();
@@ -28140,18 +29034,18 @@ function collectMap(value, previous = []) {
   return [...previous, value];
 }
 async function decryptRailsCredentials(input) {
-  const appDir = (0, import_node_path29.resolve)(input.appDir ?? process.cwd());
+  const appDir = (0, import_node_path31.resolve)(input.appDir ?? process.cwd());
   const credentialsFile = input.credentialsFile ?? DEFAULT_RAILS_CREDENTIALS_FILE;
   const masterKeyFile = input.masterKeyFile ?? DEFAULT_RAILS_MASTER_KEY_FILE;
-  const credentialsPath = (0, import_node_path29.resolve)(appDir, credentialsFile);
-  const masterKeyPath = (0, import_node_path29.resolve)(appDir, masterKeyFile);
+  const credentialsPath = (0, import_node_path31.resolve)(appDir, credentialsFile);
+  const masterKeyPath = (0, import_node_path31.resolve)(appDir, masterKeyFile);
   const env = {
     ...process.env,
     MMI_RAILS_CREDENTIALS_FILE: credentialsPath,
     MMI_RAILS_MASTER_KEY_FILE: masterKeyPath
   };
-  if ((0, import_node_fs32.existsSync)(masterKeyPath)) {
-    env.RAILS_MASTER_KEY = (0, import_node_fs32.readFileSync)(masterKeyPath, "utf8").trim();
+  if ((0, import_node_fs35.existsSync)(masterKeyPath)) {
+    env.RAILS_MASTER_KEY = (0, import_node_fs35.readFileSync)(masterKeyPath, "utf8").trim();
   }
   const script = [
     'require "json"',
@@ -28161,9 +29055,9 @@ async function decryptRailsCredentials(input) {
     'config = ActiveSupport::EncryptedConfiguration.new(config_path: config_path, key_path: key_path, env_key: "RAILS_MASTER_KEY", raise_if_missing_key: true)',
     "puts JSON.generate(config.config)"
   ].join("\n");
-  const scriptDir = (0, import_node_fs32.mkdtempSync)((0, import_node_path29.join)((0, import_node_os14.tmpdir)(), "mmi-rails-decrypt-"));
-  const scriptPath = (0, import_node_path29.join)(scriptDir, "decrypt.rb");
-  (0, import_node_fs32.writeFileSync)(scriptPath, script, "utf8");
+  const scriptDir = (0, import_node_fs35.mkdtempSync)((0, import_node_path31.join)((0, import_node_os16.tmpdir)(), "mmi-rails-decrypt-"));
+  const scriptPath = (0, import_node_path31.join)(scriptDir, "decrypt.rb");
+  (0, import_node_fs35.writeFileSync)(scriptPath, script, "utf8");
   try {
     const args = ["exec", "ruby", scriptPath];
     const cmd = process.platform === "win32" ? "cmd.exe" : "bundle";
@@ -28175,7 +29069,7 @@ async function decryptRailsCredentials(input) {
     });
     return JSON.parse(stdout);
   } finally {
-    (0, import_node_fs32.rmSync)(scriptDir, { recursive: true, force: true });
+    (0, import_node_fs35.rmSync)(scriptDir, { recursive: true, force: true });
   }
 }
 async function readSecretStdin() {
@@ -28265,7 +29159,7 @@ function registerSecretsCommands(program3) {
     let body;
     if (o.file) {
       try {
-        body = (0, import_node_fs32.readFileSync)((0, import_node_path29.resolve)(o.file), "utf8");
+        body = (0, import_node_fs35.readFileSync)((0, import_node_path31.resolve)(o.file), "utf8");
       } catch (e) {
         return fail(`secrets org-catalog: cannot read --file ${o.file}: ${e.message}`);
       }
@@ -28370,7 +29264,7 @@ function registerSecretsCommands(program3) {
       {
         ...d,
         decryptRailsCredentials,
-        removeFile: (path2) => (0, import_node_fs32.unlinkSync)((0, import_node_path29.resolve)(o.appDir ?? process.cwd(), path2))
+        removeFile: (path2) => (0, import_node_fs35.unlinkSync)((0, import_node_path31.resolve)(o.appDir ?? process.cwd(), path2))
       },
       {
         repo: o.repo,
@@ -28415,7 +29309,7 @@ function registerSecretsCommands(program3) {
 }
 
 // src/app-actor.ts
-var import_node_crypto11 = require("node:crypto");
+var import_node_crypto13 = require("node:crypto");
 var APP_ACTOR_ENV = "MMI_ACTOR";
 var APP_VAULT_REPO = "mutmutco/MMI-Hub";
 var APP_VAULT_KEYS = ["GITHUB_APP_ID", "GITHUB_APP_INSTALLATION_ID", "GITHUB_APP_PRIVATE_KEY"];
@@ -28459,7 +29353,7 @@ function mintAppJwt(appId, privateKeyPem, nowSec) {
     exp: now + APP_JWT_TTL_S,
     iss: appId
   }));
-  const signer = (0, import_node_crypto11.createSign)("RSA-SHA256");
+  const signer = (0, import_node_crypto13.createSign)("RSA-SHA256");
   signer.update(`${header}.${payload}`);
   return `${header}.${payload}.${signer.sign(privateKeyPem, "base64url")}`;
 }
@@ -28577,7 +29471,7 @@ function emitCliCallTelemetry(command) {
 }
 
 // src/box-commands.ts
-var import_node_fs33 = require("node:fs");
+var import_node_fs36 = require("node:fs");
 init_clean_exit();
 
 // src/box.ts
@@ -28781,7 +29675,7 @@ function registerBoxCommands(program3) {
       }
       if (o.json) console.log(JSON.stringify({ box: found, incomplete }, null, 2));
       else if (o.ssh && o.script) {
-        (0, import_node_fs33.writeFileSync)(o.script, sshRecipeScript(found), "utf8");
+        (0, import_node_fs36.writeFileSync)(o.script, sshRecipeScript(found), "utf8");
         console.log(`wrote ${o.script} \u2014 run: bash "${o.script}"`);
       } else if (o.ssh) console.log(`${formatSshRecipe(found)}
 ${SSH_RECIPE_AGENT_NOTE}`);
@@ -28796,12 +29690,12 @@ ${SSH_RECIPE_AGENT_NOTE}`);
 
 // src/schedules-commands.ts
 var import_promises4 = require("node:fs/promises");
-var import_node_child_process18 = require("node:child_process");
+var import_node_child_process19 = require("node:child_process");
 var import_node_util7 = require("node:util");
 init_clean_exit();
 init_github_client();
 init_cli_shared();
-var execFileP5 = (0, import_node_util7.promisify)(import_node_child_process18.execFile);
+var execFileP5 = (0, import_node_util7.promisify)(import_node_child_process19.execFile);
 var AWS_REGION = "eu-central-1";
 var AWS_TIMEOUT_MS = 3e4;
 var AWS_RETRY_DELAY_MS = 1500;
@@ -28913,7 +29807,7 @@ async function awsJson(args) {
   try {
     return await run();
   } catch {
-    await new Promise((resolve5) => setTimeout(resolve5, AWS_RETRY_DELAY_MS));
+    await new Promise((resolve6) => setTimeout(resolve6, AWS_RETRY_DELAY_MS));
     return run();
   }
 }
@@ -29117,8 +30011,8 @@ function registerSchedulesCommands(program3) {
 
 // src/file-lock.ts
 var import_promises5 = require("node:fs/promises");
-var import_node_path30 = require("node:path");
-var sleep = (ms) => new Promise((resolve5) => setTimeout(resolve5, ms));
+var import_node_path32 = require("node:path");
+var sleep = (ms) => new Promise((resolve6) => setTimeout(resolve6, ms));
 var IMMEDIATE_RETRY_BUDGET = 3;
 var FileLockBusyError = class extends Error {
   lockPath;
@@ -29202,7 +30096,7 @@ async function releaseFileLock(lockPath, guard) {
 }
 async function withFileLock(lockPath, opts, fn) {
   const resolved = resolveFileLockOpts(opts);
-  await (0, import_promises5.mkdir)((0, import_node_path30.dirname)(lockPath), { recursive: true }).catch(() => void 0);
+  await (0, import_promises5.mkdir)((0, import_node_path32.dirname)(lockPath), { recursive: true }).catch(() => void 0);
   const guard = await acquireFileLock(lockPath, resolved, Date.now() + resolved.maxWaitMs);
   try {
     return await fn();
@@ -29213,7 +30107,7 @@ async function withFileLock(lockPath, opts, fn) {
 
 // src/schedules-lift-command.ts
 var import_promises6 = require("node:fs/promises");
-var import_node_path31 = require("node:path");
+var import_node_path33 = require("node:path");
 init_clean_exit();
 init_cli_shared();
 var DEFAULT_WORKFLOWS_DIR = ".github/workflows";
@@ -29242,7 +30136,7 @@ async function readWorkflowFiles(dir) {
   const files = [];
   for (const name of names.sort()) {
     if (!/\.ya?ml$/.test(name)) continue;
-    files.push({ path: `.github/workflows/${name}`, text: await (0, import_promises6.readFile)((0, import_node_path31.join)(dir, name), "utf8") });
+    files.push({ path: `.github/workflows/${name}`, text: await (0, import_promises6.readFile)((0, import_node_path33.join)(dir, name), "utf8") });
   }
   return files;
 }
@@ -29329,13 +30223,13 @@ init_cli_shared();
 // src/edge-tunnel.ts
 var HOSTNAME_RE = /^(?=.{1,253}$)([a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)(\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)+$/;
 var UPSTREAM_RE = /^https?:\/\/[^/\s]+(?::\d+)?(?:\/.*)?$/;
-function tunnelNameFromHostname(hostname3) {
-  return hostname3.replace(/\./g, "-").slice(0, 63);
+function tunnelNameFromHostname(hostname4) {
+  return hostname4.replace(/\./g, "-").slice(0, 63);
 }
-function planInfraTunnel(hostname3, upstream) {
-  const host = hostname3.trim().toLowerCase();
+function planInfraTunnel(hostname4, upstream) {
+  const host = hostname4.trim().toLowerCase();
   const origin = upstream.trim();
-  if (!HOSTNAME_RE.test(host)) throw new Error(`invalid hostname ${JSON.stringify(hostname3)}`);
+  if (!HOSTNAME_RE.test(host)) throw new Error(`invalid hostname ${JSON.stringify(hostname4)}`);
   if (!UPSTREAM_RE.test(origin)) throw new Error(`invalid upstream ${JSON.stringify(upstream)} \u2014 expected http(s)://host:port`);
   const tunnelName = tunnelNameFromHostname(host);
   const configYaml = [
@@ -29393,15 +30287,149 @@ function registerEdgeCommands(program3) {
 }
 
 // src/bootstrap-commands.ts
-var import_node_fs34 = require("node:fs");
-var import_node_os15 = require("node:os");
-var import_node_path32 = require("node:path");
+var import_node_fs38 = require("node:fs");
+var import_node_os17 = require("node:os");
+var import_node_path35 = require("node:path");
 init_cli_shared();
 init_clean_exit();
 init_github_client();
 
+// src/port-range-assign.ts
+init_cli_shared();
+
+// src/port-registry.ts
+var import_node_fs37 = require("node:fs");
+var import_node_path34 = require("node:path");
+
+// ../infra/port-geometry.mjs
+var PORT_BLOCK = 100;
+var PORT_SPAN = 10;
+var PORT_FIRST = 3e3;
+
+// src/port-registry.ts
+function nextPortBlock(registry2) {
+  const bases = Object.values(registry2).map(([start]) => start);
+  const base = bases.length ? Math.max(...bases) + PORT_BLOCK : PORT_FIRST;
+  return [base, base + PORT_SPAN];
+}
+function loadPortRegistry(path2) {
+  if (!(0, import_node_fs37.existsSync)(path2)) return {};
+  const raw = JSON.parse((0, import_node_fs37.readFileSync)(path2, "utf8"));
+  const out = {};
+  for (const [key, value] of Object.entries(raw)) {
+    if (Array.isArray(value) && value.length === 2 && value.every((n) => typeof n === "number")) {
+      out[key] = [value[0], value[1]];
+    }
+  }
+  return out;
+}
+function ensurePortRange(repo, path2) {
+  const registry2 = loadPortRegistry(path2);
+  const existing = registry2[repo];
+  if (existing) return existing;
+  const range = nextPortBlock(registry2);
+  const raw = (0, import_node_fs37.existsSync)(path2) ? JSON.parse((0, import_node_fs37.readFileSync)(path2, "utf8")) : {};
+  raw[repo] = range;
+  (0, import_node_fs37.writeFileSync)(path2, JSON.stringify(raw, null, 2) + "\n", "utf8");
+  return range;
+}
+function portCursorSeed(registry2) {
+  return nextPortBlock(registry2)[0];
+}
+function metaPortRange(meta) {
+  const r = meta?.portRange;
+  if (r && typeof r.start === "number" && typeof r.end === "number") return [r.start, r.end];
+  return null;
+}
+function decidePortRange(input) {
+  if (!input.metaReadOk) {
+    return { action: "fail", reason: "could not verify the existing port block (Hub registry read failed) \u2014 retry; NOT allocating (a re-allocation on an unverified read would advance the cursor and hand out a duplicate block)" };
+  }
+  if (input.metaPortRange) return { action: "return", range: input.metaPortRange };
+  return { action: "allocate" };
+}
+function existingPortRange(repo, registry2) {
+  return registry2[repo] ?? null;
+}
+function portRangeInfraAt(root, source) {
+  const registryPath = (0, import_node_path34.join)(root, "infra", "port-ranges.json");
+  const ddbScriptPath = (0, import_node_path34.join)(root, "infra", "port-ddb.mjs");
+  if (!(0, import_node_fs37.existsSync)(registryPath) || !(0, import_node_fs37.existsSync)(ddbScriptPath)) return null;
+  return { root, source, registryPath, ddbScriptPath };
+}
+function resolvePortRangeInfra(cwd, packageDir) {
+  const direct = portRangeInfraAt(cwd, "cwd");
+  if (direct) return direct;
+  for (let dir = cwd; ; dir = (0, import_node_path34.dirname)(dir)) {
+    const sibling = portRangeInfraAt((0, import_node_path34.join)(dir, "MMI-Hub"), "sibling-hub");
+    if (sibling) return sibling;
+    const parent = (0, import_node_path34.dirname)(dir);
+    if (parent === dir) break;
+  }
+  if (packageDir) {
+    const pkgRoot = (0, import_node_path34.join)(packageDir, "..", "..");
+    const pkgFrom = portRangeInfraAt(pkgRoot, "pkg-root");
+    if (pkgFrom) return pkgFrom;
+  }
+  return null;
+}
+async function ensurePortRangeAtomic(repo, path2, allocate, opts = {}) {
+  const registry2 = loadPortRegistry(path2);
+  const existing = existingPortRange(repo, registry2);
+  if (existing) return { range: existing, source: "existing" };
+  const seed = portCursorSeed(registry2);
+  try {
+    const range = await allocate(seed);
+    return { range, source: "ddb" };
+  } catch (e) {
+    if (!opts.quiet) console.warn(`port-registry: DDB allocator unreachable, falling back to committed file (${e.message})`);
+    return { range: ensurePortRange(repo, path2), source: "file" };
+  }
+}
+
+// src/port-range-assign.ts
+async function assignPersistedPortRange(repo, slug, reg, opts) {
+  const read = await fetchProjectBySlugChecked(slug, reg);
+  const decision = decidePortRange({ metaReadOk: read.ok, metaPortRange: read.ok ? metaPortRange(read.project) : null });
+  if (decision.action === "fail") {
+    return { ok: false, error: `${decision.reason}${read.ok ? "" : ` (${read.error})`}` };
+  }
+  if (decision.action === "return") {
+    return { ok: true, range: decision.range, source: "meta", persisted: true };
+  }
+  const infra = resolvePortRangeInfra(opts.cwd, opts.moduleDir);
+  if (!infra) {
+    return {
+      ok: false,
+      error: `no MMI-Hub allocator files found (checked cwd ${opts.cwd}, sibling MMI-Hub dirs, and the installed package location); ensure the Hub's infra/port-ranges.json and infra/port-ddb.mjs are reachable`
+    };
+  }
+  const path2 = infra.registryPath;
+  const allocate = async (seed) => {
+    const { stdout } = await execFileP2("node", [infra.ddbScriptPath, String(seed)], { timeout: 15e3 });
+    const parsed = JSON.parse(stdout);
+    if (!Array.isArray(parsed.range) || parsed.range.length !== 2) throw new Error("port-ddb: no range in output");
+    return parsed.range;
+  };
+  const { range: [start, end], source } = await ensurePortRangeAtomic(repo, path2, allocate);
+  const write = await upsertProject(slug, { portRange: { start, end } }, reg);
+  if (!write.ok && source === "ddb") {
+    return {
+      ok: false,
+      error: `block [${start}, ${end}] was allocated (cursor advanced) but NOT recorded in the registry META (${write.error ?? `HTTP ${write.status}`}) \u2014 fix auth/connectivity and retry so the block is persisted; do not re-run blind`
+    };
+  }
+  return {
+    ok: true,
+    range: [start, end],
+    source: "allocated",
+    persisted: write.ok,
+    ...write.ok ? {} : { persistError: write.error ?? `HTTP ${write.status}` }
+  };
+}
+
 // src/bootstrap-drift.ts
-var import_node_crypto12 = require("node:crypto");
+var import_node_crypto14 = require("node:crypto");
 function byteComparableSeeds(manifest, cls) {
   return manifest.seeds.filter((s) => s.ownership === "org" && s.source === "self" && s.classes.includes(cls));
 }
@@ -29421,7 +30449,7 @@ function compareSeedBytes(hubContent, repoContent) {
   return normalize(hubContent) === normalize(repoContent) ? "match" : "drift";
 }
 function seedContentHash(content) {
-  return (0, import_node_crypto12.createHash)("sha256").update(content.replace(/\r\n/g, "\n"), "utf8").digest("hex");
+  return (0, import_node_crypto14.createHash)("sha256").update(content.replace(/\r\n/g, "\n"), "utf8").digest("hex");
 }
 function auditRepoSeedDrift(repo, seeds, hubContents, repoReads) {
   const byTarget = new Map(repoReads.map((r) => [r.target, r.content]));
@@ -29582,7 +30610,7 @@ function renderPropagationReport(plan) {
 }
 
 // src/bootstrap-propagation-identity.ts
-var import_node_crypto13 = require("node:crypto");
+var import_node_crypto15 = require("node:crypto");
 var PROPAGATION_BRANCH_PREFIX = "seed-propagate-";
 var TARGET_MARKER_NAME = "mmi-bootstrap-propagation-target";
 function safeBranchPart(value, maxLength, fallback) {
@@ -29595,7 +30623,7 @@ function repoSlug2(repo) {
 function propagationBranch(repo, target) {
   const repoPart = safeBranchPart(repoSlug2(repo), 32, "repo");
   const targetPart = safeBranchPart(target, 48, "target");
-  const hash = (0, import_node_crypto13.createHash)("sha256").update(repo.trim().toLowerCase()).update("\0").update(target).digest("hex").slice(0, 12);
+  const hash = (0, import_node_crypto15.createHash)("sha256").update(repo.trim().toLowerCase()).update("\0").update(target).digest("hex").slice(0, 12);
   return `${PROPAGATION_BRANCH_PREFIX}${repoPart}-${targetPart}-${hash}`;
 }
 function legacyPropagationBranch(repo) {
@@ -30035,6 +31063,20 @@ function filledDocCheck(label, text, path2) {
   const unfilled = unfilledDocPlaceholders(text);
   return { ok: unfilled.length === 0, label, detail: unfilled.length ? `unfilled: ${unfilled.join(", ")}` : void 0 };
 }
+function isCentralContainerDeployModel(model) {
+  return model === "tenant-container" || model === "solo-container";
+}
+function centralContainerPortRangeCheck(deployModel, portRange, repo) {
+  if (!isCentralContainerDeployModel(deployModel)) return null;
+  const start = portRange?.start;
+  const end = portRange?.end;
+  const ok = typeof start === "number" && typeof end === "number" && Number.isFinite(start) && Number.isFinite(end) && start <= end;
+  return {
+    ok,
+    label: "Hub registry portRange present for local stage",
+    detail: ok ? void 0 : `${deployModel} needs PROJECT# META.portRange for mmi-cli stage \u2014 assign with: mmi-cli stage port-range ${repo}`
+  };
+}
 async function verifyBootstrap(repo, repoClass, deps, releaseTrack) {
   const branchesWanted = expectedBranches(repoClass, releaseTrack);
   const baseBranch = releaseTrack === "trunk" || repoClass === "content" ? "main" : "development";
@@ -30128,6 +31170,8 @@ async function verifyBootstrap(repo, repoClass, deps, releaseTrack) {
       });
     }
   }
+  const portRangeCheck = centralContainerPortRangeCheck(deps.deployModel, deps.projectMeta?.portRange, repo);
+  if (portRangeCheck) checks.push(portRangeCheck);
   const readme = await contentText(deps, repo, baseBranch, "README.md");
   checks.push({
     ok: readme !== null && readme.includes("## Agent context"),
@@ -30397,13 +31441,13 @@ function registerBootstrapCommands(program3) {
       client: defaultGitHubClient(),
       projectMeta: meta,
       deployModel: typeof meta?.deployModel === "string" ? meta.deployModel : void 0,
-      readLocalFile: (path2) => path2 === "projects.json" && apiProjects != null ? apiProjects : (0, import_node_fs34.existsSync)(path2) ? (0, import_node_fs34.readFileSync)(path2, "utf8") : null,
+      readLocalFile: (path2) => path2 === "projects.json" && apiProjects != null ? apiProjects : (0, import_node_fs38.existsSync)(path2) ? (0, import_node_fs38.readFileSync)(path2, "utf8") : null,
       // requiredGcpApis is stored as an array by a JSON write, but `org project set --var KEY=VALUE` stores a raw
       // comma-string — accept either so the seeded value verifies regardless of how it was written.
       // #3689: the same committed map the org access audit reads (#3664), so a sanctioned admin is not a
       // permanent bootstrap failure on one surface and an intended state on the other. Absent file → no
       // sanction, which is the pre-#3664 behaviour.
-      sanctionedAdmins: (0, import_node_fs34.existsSync)("access-matrix.json") ? entriesValueByCanonicalRepo(loadSanctionedAdmins((0, import_node_fs34.readFileSync)("access-matrix.json", "utf8")), repo) : void 0,
+      sanctionedAdmins: (0, import_node_fs38.existsSync)("access-matrix.json") ? entriesValueByCanonicalRepo(loadSanctionedAdmins((0, import_node_fs38.readFileSync)("access-matrix.json", "utf8")), repo) : void 0,
       requiredGcpApis: (() => {
         const v = meta?.requiredGcpApis;
         if (Array.isArray(v)) return v;
@@ -30456,14 +31500,14 @@ function registerBootstrapCommands(program3) {
   bootstrap.command("drift").description("#3818: compare every org-owned whole-file seed against MMI-Hub's copy across the registry roster; read-only").option("--repo <owner/repo>", "audit one repo instead of the roster (never a fleet verdict)").option("--json", "machine-readable output").action(async () => {
     const o = { repo: rawValue("--repo", ""), json: rawFlag("--json") };
     const manifestPath = "skills/bootstrap/seeds/manifest.json";
-    if (!(0, import_node_fs34.existsSync)(manifestPath)) return fail(`bootstrap drift: ${manifestPath} not found; run from the MMI-Hub repo root \u2014 the Hub's copies ARE the reference this compares against`);
+    if (!(0, import_node_fs38.existsSync)(manifestPath)) return fail(`bootstrap drift: ${manifestPath} not found; run from the MMI-Hub repo root \u2014 the Hub's copies ARE the reference this compares against`);
     const seedSource = await resolveHubSeedSource(execGitForSeedSource);
     if (!seedSource.ok) return fail(`bootstrap drift: ${seedSource.reason}`);
-    const manifest = loadBootstrapSeeds((0, import_node_fs34.readFileSync)(manifestPath, "utf8"));
+    const manifest = loadBootstrapSeeds((0, import_node_fs38.readFileSync)(manifestPath, "utf8"));
     const hubContents = /* @__PURE__ */ new Map();
     for (const s of manifest.seeds) {
       if (s.ownership !== "org" || s.source !== "self") continue;
-      hubContents.set(s.target, (0, import_node_fs34.existsSync)(s.target) ? (0, import_node_fs34.readFileSync)(s.target, "utf8") : null);
+      hubContents.set(s.target, (0, import_node_fs38.existsSync)(s.target) ? (0, import_node_fs38.readFileSync)(s.target, "utf8") : null);
     }
     let targets;
     let classOf = (_repo) => "deployable";
@@ -30581,10 +31625,10 @@ function registerBootstrapCommands(program3) {
       return;
     }
     const manifestPath = "skills/bootstrap/seeds/manifest.json";
-    if (!(0, import_node_fs34.existsSync)(manifestPath)) return fail(`bootstrap apply: ${manifestPath} not found; bootstrap runs from the MMI-Hub repo root by design \u2014 it stamps org-level resources (Project, Ruleset, secrets, access) through the GitHub App, which is only authorized from the Hub checkout`);
+    if (!(0, import_node_fs38.existsSync)(manifestPath)) return fail(`bootstrap apply: ${manifestPath} not found; bootstrap runs from the MMI-Hub repo root by design \u2014 it stamps org-level resources (Project, Ruleset, secrets, access) through the GitHub App, which is only authorized from the Hub checkout`);
     const seedSource = await resolveHubSeedSource(execGitForSeedSource);
     if (!seedSource.ok) return fail(`bootstrap apply: ${seedSource.reason}`);
-    const manifest = loadBootstrapSeeds((0, import_node_fs34.readFileSync)(manifestPath, "utf8"));
+    const manifest = loadBootstrapSeeds((0, import_node_fs38.readFileSync)(manifestPath, "utf8"));
     const baseBranch = o.class === "content" ? "main" : "development";
     const slug = parsedRepo.slug;
     const onlyTarget = o.only.trim();
@@ -30596,16 +31640,16 @@ function registerBootstrapCommands(program3) {
     }
     const onlyManagedBlock = onlyTarget ? seedsToApply[0]?.managedBlock != null : false;
     const gh = async (args) => execFileP2("gh", args, { timeout: 2e4 });
-    const readFile7 = (p) => (0, import_node_fs34.existsSync)(p) ? (0, import_node_fs34.readFileSync)(p, "utf8") : null;
+    const readFile7 = (p) => (0, import_node_fs38.existsSync)(p) ? (0, import_node_fs38.readFileSync)(p, "utf8") : null;
     const enc = (p) => p.split("/").map(encodeURIComponent).join("/");
     const putSeed = async (target, content, ref, sha) => {
-      const tmp = (0, import_node_path32.join)((0, import_node_os15.tmpdir)(), `mmi-seed-${process.pid}-${Date.now().toString(36)}-${Math.random().toString(36).slice(2)}.json`);
-      (0, import_node_fs34.writeFileSync)(tmp, JSON.stringify(contentPutBody(target, content, ref, sha)), "utf8");
+      const tmp = (0, import_node_path35.join)((0, import_node_os17.tmpdir)(), `mmi-seed-${process.pid}-${Date.now().toString(36)}-${Math.random().toString(36).slice(2)}.json`);
+      (0, import_node_fs38.writeFileSync)(tmp, JSON.stringify(contentPutBody(target, content, ref, sha)), "utf8");
       try {
         await gh(contentPutInputArgs(repo, target, tmp));
       } finally {
         try {
-          (0, import_node_fs34.unlinkSync)(tmp);
+          (0, import_node_fs38.unlinkSync)(tmp);
         } catch {
         }
       }
@@ -30878,10 +31922,32 @@ ${onlyManagedBlock ? `Only the marker-bounded Hub-managed block inside repo-owne
     }
     if (o.execute && !onlyTarget) {
       const cfg = await loadConfig();
-      const res = await registerProject(registerPayload, registryClientDeps(cfg));
+      const reg = registryClientDeps(cfg);
+      const res = await registerProject(registerPayload, reg);
       if (res.ok) {
         ddbWrites.push({ slug: registerPayload.slug, action: "register", record: registerPayload });
         applied.push(`ddb register ${registerPayload.slug}`);
+        const deployModel = typeof registerPayload.deployModel === "string" ? registerPayload.deployModel : void 0;
+        if (deployModel === "tenant-container" || deployModel === "solo-container") {
+          const shortName = typeof registerPayload.name === "string" ? registerPayload.name : typeof registerPayload.slug === "string" ? registerPayload.slug : repo.split("/")[1] || repo;
+          const assigned = await assignPersistedPortRange(shortName, registerPayload.slug, reg, {
+            cwd: process.cwd(),
+            moduleDir: __dirname
+          });
+          if (assigned.ok) {
+            const [start, end] = assigned.range;
+            ddbWrites.push({
+              slug: registerPayload.slug,
+              action: "portRange",
+              record: { portRange: { start, end }, source: assigned.source, persisted: assigned.persisted }
+            });
+            applied.push(
+              assigned.source === "meta" ? `portRange [${start}, ${end}] (already on META)` : `portRange [${start}, ${end}] (${assigned.persisted ? "persisted" : `META not persisted: ${assigned.persistError}`})`
+            );
+          } else {
+            applied.push(`portRange (failed: ${assigned.error})`);
+          }
+        }
       } else {
         const why = res.error ?? `HTTP ${res.status}${res.body?.error ? ` \u2014 ${res.body.error}` : ""}`;
         applied.push(`ddb register ${registerPayload.slug} (failed: ${why})`);
@@ -30898,10 +31964,10 @@ LIVE apply to ${repo}:
   bootstrap.command("propagate").description("#4238: re-entrant canary\u2192wave tick \u2014 plan (or, with --execute, open) per-repo PRs fanning an org-owned seed out to the fleet").option("--target <path>", "the manifest target to propagate (an org-owned whole file or declared Hub-managed block)").option("--execute", "LIVE tick via gh (master-gated) \u2014 opens/reuses per-repo seed-propagate PRs; dry-run prints the plan only").option("--json", "machine-readable output").action(async () => {
     const o = { target: rawValue("--target", ""), execute: rawFlag("--execute"), json: rawFlag("--json") };
     const manifestPath = "skills/bootstrap/seeds/manifest.json";
-    if (!(0, import_node_fs34.existsSync)(manifestPath)) return fail(`bootstrap propagate: ${manifestPath} not found; run from the MMI-Hub repo root \u2014 the Hub's copies ARE the desired state this tick propagates`);
+    if (!(0, import_node_fs38.existsSync)(manifestPath)) return fail(`bootstrap propagate: ${manifestPath} not found; run from the MMI-Hub repo root \u2014 the Hub's copies ARE the desired state this tick propagates`);
     const seedSource = await resolveHubSeedSource(execGitForSeedSource);
     if (!seedSource.ok) return fail(`bootstrap propagate: ${seedSource.reason}`);
-    const manifest = loadBootstrapSeeds((0, import_node_fs34.readFileSync)(manifestPath, "utf8"));
+    const manifest = loadBootstrapSeeds((0, import_node_fs38.readFileSync)(manifestPath, "utf8"));
     const propagatable = manifest.seeds.filter(isPropagatableSeed);
     if (!o.target) {
       return fail(`bootstrap propagate: --target <path> is required \u2014 one of:
@@ -30910,9 +31976,9 @@ LIVE apply to ${repo}:
     const seed = propagatable.find((s) => s.target === o.target);
     if (!seed) return fail(`bootstrap propagate: --target '${o.target}' names no centrally propagatable seed in ${manifestPath}. Propagatable targets:
   ${propagatable.map((s) => s.target).join("\n  ")}`);
-    if (!seed.managedBlock && !(0, import_node_fs34.existsSync)(seed.target)) return fail(`bootstrap propagate: the Hub's own copy of '${seed.target}' is missing \u2014 nothing to propagate`);
-    const hubContent = seed.managedBlock ? null : (0, import_node_fs34.readFileSync)(seed.target, "utf8");
-    const readSeedFile = (path2) => (0, import_node_fs34.existsSync)(path2) ? (0, import_node_fs34.readFileSync)(path2, "utf8") : null;
+    if (!seed.managedBlock && !(0, import_node_fs38.existsSync)(seed.target)) return fail(`bootstrap propagate: the Hub's own copy of '${seed.target}' is missing \u2014 nothing to propagate`);
+    const hubContent = seed.managedBlock ? null : (0, import_node_fs38.readFileSync)(seed.target, "utf8");
+    const readSeedFile = (path2) => (0, import_node_fs38.existsSync)(path2) ? (0, import_node_fs38.readFileSync)(path2, "utf8") : null;
     const isWorkflowSeed = seed.target.startsWith(".github/workflows/");
     const cfg = await loadConfig();
     const projects = await fetchProjectsList(registryClientDeps(cfg));
@@ -30921,9 +31987,9 @@ LIVE apply to ${repo}:
     }
     const rosterRepos2 = collectRegistryRepos(projects).filter((r) => r.toLowerCase() !== "mutmutco/mmi-hub");
     let independentCount = rosterRepos2.length;
-    if ((0, import_node_fs34.existsSync)("projects.json")) {
+    if ((0, import_node_fs38.existsSync)("projects.json")) {
       try {
-        const local = JSON.parse((0, import_node_fs34.readFileSync)("projects.json", "utf8"));
+        const local = JSON.parse((0, import_node_fs38.readFileSync)("projects.json", "utf8"));
         const localRepos = /* @__PURE__ */ new Set();
         for (const p of local.projects ?? []) for (const r of p.repos ?? []) {
           const full = (r.includes("/") ? r : `mutmutco/${r}`).toLowerCase();
@@ -31070,15 +32136,15 @@ LIVE apply to ${repo}:
         } catch {
           existingSha = void 0;
         }
-        const tmp = (0, import_node_path32.join)((0, import_node_os15.tmpdir)(), `mmi-propagate-${process.pid}-${Date.now().toString(36)}-${Math.random().toString(36).slice(2)}.json`);
+        const tmp = (0, import_node_path35.join)((0, import_node_os17.tmpdir)(), `mmi-propagate-${process.pid}-${Date.now().toString(36)}-${Math.random().toString(36).slice(2)}.json`);
         const desiredContent = desiredByRepo.get(rec.repo);
         if (desiredContent == null) return fail(`bootstrap propagate: no resolved content for ${rec.repo} ${seed.target} \u2014 refusing to write`);
-        (0, import_node_fs34.writeFileSync)(tmp, JSON.stringify(contentPutBody(seed.target, desiredContent, branch, existingSha)), "utf8");
+        (0, import_node_fs38.writeFileSync)(tmp, JSON.stringify(contentPutBody(seed.target, desiredContent, branch, existingSha)), "utf8");
         try {
           await gh(contentPutInputArgs(rec.repo, seed.target, tmp));
         } finally {
           try {
-            (0, import_node_fs34.unlinkSync)(tmp);
+            (0, import_node_fs38.unlinkSync)(tmp);
           } catch {
           }
         }
@@ -31145,10 +32211,10 @@ Rollback: \`mmi-cli devops bootstrap rollback ${rec.repo} --target ${seed.target
       return fail(`bootstrap rollback: ${e.message}`);
     }
     const manifestPath = "skills/bootstrap/seeds/manifest.json";
-    if (!(0, import_node_fs34.existsSync)(manifestPath)) return fail(`bootstrap rollback: ${manifestPath} not found; run from the MMI-Hub repo root \u2014 the manifest names which targets are org-owned and therefore propagated (and rollback-able)`);
+    if (!(0, import_node_fs38.existsSync)(manifestPath)) return fail(`bootstrap rollback: ${manifestPath} not found; run from the MMI-Hub repo root \u2014 the manifest names which targets are org-owned and therefore propagated (and rollback-able)`);
     const seedSource = await resolveHubSeedSource(execGitForSeedSource);
     if (!seedSource.ok) return fail(`bootstrap rollback: ${seedSource.reason}`);
-    const manifest = loadBootstrapSeeds((0, import_node_fs34.readFileSync)(manifestPath, "utf8"));
+    const manifest = loadBootstrapSeeds((0, import_node_fs38.readFileSync)(manifestPath, "utf8"));
     const propagatable = manifest.seeds.filter(isPropagatableSeed);
     if (!o.target) {
       return fail(`bootstrap rollback: --target <path> is required \u2014 one of:
@@ -31165,10 +32231,10 @@ Rollback: \`mmi-cli devops bootstrap rollback ${rec.repo} --target ${seed.target
     const enc = (p) => p.split("/").map(encodeURIComponent).join("/");
     let candidates;
     if (o.record) {
-      if (!(0, import_node_fs34.existsSync)(o.record)) return fail(`bootstrap rollback: --record '${o.record}' not found`);
+      if (!(0, import_node_fs38.existsSync)(o.record)) return fail(`bootstrap rollback: --record '${o.record}' not found`);
       let parsed;
       try {
-        parsed = JSON.parse((0, import_node_fs34.readFileSync)(o.record, "utf8"));
+        parsed = JSON.parse((0, import_node_fs38.readFileSync)(o.record, "utf8"));
       } catch (e) {
         return fail(`bootstrap rollback: --record '${o.record}' is not valid JSON: ${e.message}`);
       }
@@ -31245,13 +32311,13 @@ Rollback: \`mmi-cli devops bootstrap rollback ${rec.repo} --target ${seed.target
       } catch {
         existingSha = void 0;
       }
-      const tmp = (0, import_node_path32.join)((0, import_node_os15.tmpdir)(), `mmi-rollback-${process.pid}-${Date.now().toString(36)}-${Math.random().toString(36).slice(2)}.json`);
-      (0, import_node_fs34.writeFileSync)(tmp, JSON.stringify(contentPutBody(seed.target, preSeedContent, plan.branch, existingSha)), "utf8");
+      const tmp = (0, import_node_path35.join)((0, import_node_os17.tmpdir)(), `mmi-rollback-${process.pid}-${Date.now().toString(36)}-${Math.random().toString(36).slice(2)}.json`);
+      (0, import_node_fs38.writeFileSync)(tmp, JSON.stringify(contentPutBody(seed.target, preSeedContent, plan.branch, existingSha)), "utf8");
       try {
         await gh(contentPutInputArgs(repo, seed.target, tmp));
       } finally {
         try {
-          (0, import_node_fs34.unlinkSync)(tmp);
+          (0, import_node_fs38.unlinkSync)(tmp);
         } catch {
         }
       }
@@ -31276,101 +32342,11 @@ Rollback: \`mmi-cli devops bootstrap rollback ${rec.repo} --target ${seed.target
 }
 
 // src/stage-commands.ts
-var import_node_fs36 = require("node:fs");
-var import_node_path34 = require("node:path");
+var import_node_fs39 = require("node:fs");
+var import_node_path36 = require("node:path");
 init_cli_shared();
 init_clean_exit();
 
-// src/port-registry.ts
-var import_node_fs35 = require("node:fs");
-var import_node_path33 = require("node:path");
-
-// ../infra/port-geometry.mjs
-var PORT_BLOCK = 100;
-var PORT_SPAN = 10;
-var PORT_FIRST = 3e3;
-
-// src/port-registry.ts
-function nextPortBlock(registry2) {
-  const bases = Object.values(registry2).map(([start]) => start);
-  const base = bases.length ? Math.max(...bases) + PORT_BLOCK : PORT_FIRST;
-  return [base, base + PORT_SPAN];
-}
-function loadPortRegistry(path2) {
-  if (!(0, import_node_fs35.existsSync)(path2)) return {};
-  const raw = JSON.parse((0, import_node_fs35.readFileSync)(path2, "utf8"));
-  const out = {};
-  for (const [key, value] of Object.entries(raw)) {
-    if (Array.isArray(value) && value.length === 2 && value.every((n) => typeof n === "number")) {
-      out[key] = [value[0], value[1]];
-    }
-  }
-  return out;
-}
-function ensurePortRange(repo, path2) {
-  const registry2 = loadPortRegistry(path2);
-  const existing = registry2[repo];
-  if (existing) return existing;
-  const range = nextPortBlock(registry2);
-  const raw = (0, import_node_fs35.existsSync)(path2) ? JSON.parse((0, import_node_fs35.readFileSync)(path2, "utf8")) : {};
-  raw[repo] = range;
-  (0, import_node_fs35.writeFileSync)(path2, JSON.stringify(raw, null, 2) + "\n", "utf8");
-  return range;
-}
-function portCursorSeed(registry2) {
-  return nextPortBlock(registry2)[0];
-}
-function metaPortRange(meta) {
-  const r = meta?.portRange;
-  if (r && typeof r.start === "number" && typeof r.end === "number") return [r.start, r.end];
-  return null;
-}
-function decidePortRange(input) {
-  if (!input.metaReadOk) {
-    return { action: "fail", reason: "could not verify the existing port block (Hub registry read failed) \u2014 retry; NOT allocating (a re-allocation on an unverified read would advance the cursor and hand out a duplicate block)" };
-  }
-  if (input.metaPortRange) return { action: "return", range: input.metaPortRange };
-  return { action: "allocate" };
-}
-function existingPortRange(repo, registry2) {
-  return registry2[repo] ?? null;
-}
-function portRangeInfraAt(root, source) {
-  const registryPath = (0, import_node_path33.join)(root, "infra", "port-ranges.json");
-  const ddbScriptPath = (0, import_node_path33.join)(root, "infra", "port-ddb.mjs");
-  if (!(0, import_node_fs35.existsSync)(registryPath) || !(0, import_node_fs35.existsSync)(ddbScriptPath)) return null;
-  return { root, source, registryPath, ddbScriptPath };
-}
-function resolvePortRangeInfra(cwd, packageDir) {
-  const direct = portRangeInfraAt(cwd, "cwd");
-  if (direct) return direct;
-  for (let dir = cwd; ; dir = (0, import_node_path33.dirname)(dir)) {
-    const sibling = portRangeInfraAt((0, import_node_path33.join)(dir, "MMI-Hub"), "sibling-hub");
-    if (sibling) return sibling;
-    const parent = (0, import_node_path33.dirname)(dir);
-    if (parent === dir) break;
-  }
-  if (packageDir) {
-    const pkgRoot = (0, import_node_path33.join)(packageDir, "..", "..");
-    const pkgFrom = portRangeInfraAt(pkgRoot, "pkg-root");
-    if (pkgFrom) return pkgFrom;
-  }
-  return null;
-}
-async function ensurePortRangeAtomic(repo, path2, allocate, opts = {}) {
-  const registry2 = loadPortRegistry(path2);
-  const existing = existingPortRange(repo, registry2);
-  if (existing) return { range: existing, source: "existing" };
-  const seed = portCursorSeed(registry2);
-  try {
-    const range = await allocate(seed);
-    return { range, source: "ddb" };
-  } catch (e) {
-    if (!opts.quiet) console.warn(`port-registry: DDB allocator unreachable, falling back to committed file (${e.message})`);
-    return { range: ensurePortRange(repo, path2), source: "file" };
-  }
-}
-
 // src/stage-default.ts
 function shellFor(platform2 = process.platform) {
   return platform2 === "win32" ? "powershell" : "bash";
@@ -31378,14 +32354,20 @@ function shellFor(platform2 = process.platform) {
 function isCentralContainerModel(model) {
   return model === "tenant-container" || model === "solo-container";
 }
-function deriveStageGap(inputs) {
+function stagePortRangeRecovery(repo = "<owner/repo>") {
+  return `mmi-cli stage port-range ${repo}`;
+}
+function deriveStageGap(inputs, opts) {
   const missing = [];
   if (!isCentralContainerModel(inputs.deployModel)) {
     return `local stage default applies to central-container repos only (tenant-container/solo-container; registry deployModel = ${inputs.deployModel ?? "unset"})`;
   }
   if (!inputs.hasCompose) missing.push("docker-compose.yml");
   if (!inputs.portRange) missing.push("Hub registry portRange");
-  return missing.length ? `cannot derive a default local stage \u2014 missing: ${missing.join(", ")}` : null;
+  if (!missing.length) return null;
+  const base = `cannot derive a default local stage \u2014 missing: ${missing.join(", ")}`;
+  if (!inputs.portRange) return `${base} \u2014 assign with: ${stagePortRangeRecovery(opts?.repo)}`;
+  return base;
 }
 function deriveStage(inputs) {
   if (deriveStageGap(inputs) || !inputs.portRange) return null;
@@ -31416,7 +32398,7 @@ function stageUrlForPort(port) {
   return `http://127.0.0.1:${port}/`;
 }
 function decideStage(inputs) {
-  const { registry: registry2, hasCompose, hasEnvExample } = inputs;
+  const { registry: registry2, hasCompose, hasEnvExample, repo } = inputs;
   const deriveInputs = {
     portRange: registry2.portRange,
     deployModel: registry2.deployModel,
@@ -31426,8 +32408,9 @@ function decideStage(inputs) {
   const derived = deriveStage(deriveInputs);
   if (derived) return { source: "derived", derived, registryError: registry2.error };
   const registryGap = registry2.error ? `Hub registry read failed (${registry2.error}) \u2014 cannot derive a default local stage` : null;
-  const gap = registryGap ?? deriveStageGap(deriveInputs) ?? "no registry-derived default available";
-  return { source: "none", gap, registryError: registry2.error };
+  const gap = registryGap ?? deriveStageGap(deriveInputs, { repo }) ?? "no registry-derived default available";
+  const recovery = !registry2.error && isCentralContainerModel(registry2.deployModel) && !registry2.portRange ? stagePortRangeRecovery(repo) : void 0;
+  return { source: "none", gap, ...recovery ? { recovery } : {}, registryError: registry2.error };
 }
 
 // src/stage-live.ts
@@ -31637,14 +32620,17 @@ function registerStageCommands(program3) {
   }
   async function resolveStage() {
     const cfg = await loadConfig();
-    const read = await fetchProjectBySlugChecked(await repoSlug(), registryClientDeps(cfg)).catch((e) => ({ ok: false, error: e.message }));
+    const slug = await repoSlug();
+    const read = await fetchProjectBySlugChecked(slug, registryClientDeps(cfg)).catch((e) => ({ ok: false, error: e.message }));
     const project2 = read.ok ? read.project : null;
     const portRangeMeta = project2?.portRange ?? void 0;
     const portRange = portRangeMeta && typeof portRangeMeta.start === "number" && typeof portRangeMeta.end === "number" ? [portRangeMeta.start, portRangeMeta.end] : void 0;
+    const repo = Array.isArray(project2?.repos) && typeof project2.repos[0] === "string" ? project2.repos[0] : slug;
     return decideStage({
       registry: { deployModel: project2?.deployModel, portRange, error: read.ok ? void 0 : read.error },
-      hasCompose: (0, import_node_fs36.existsSync)((0, import_node_path34.join)(process.cwd(), "docker-compose.yml")),
-      hasEnvExample: (0, import_node_fs36.existsSync)((0, import_node_path34.join)(process.cwd(), ".env.example"))
+      hasCompose: (0, import_node_fs39.existsSync)((0, import_node_path36.join)(process.cwd(), "docker-compose.yml")),
+      hasEnvExample: (0, import_node_fs39.existsSync)((0, import_node_path36.join)(process.cwd(), ".env.example")),
+      repo
     });
   }
   async function fetchStageVaultEnvMerge() {
@@ -31689,7 +32675,16 @@ function registerStageCommands(program3) {
   }
   function stageStepsFor(res, stops = true) {
     if (res.source === "derived" && res.derived) return derivedStagePlan(res.derived, shellFor(), stops);
-    return [{ label: `no local stage to run \u2014 ${res.gap ?? "stage config gap"}` }];
+    return [{ label: `no local stage to run \u2014 ${res.gap ?? "stage config gap"}`, ...res.recovery ? { command: res.recovery } : {} }];
+  }
+  function stageReceiptFields(res) {
+    return {
+      source: res.source,
+      url: res.derived?.url,
+      ...res.gap ? { gap: res.gap } : {},
+      ...res.recovery ? { recovery: res.recovery } : {},
+      ...res.registryError ? { registryError: res.registryError } : {}
+    };
   }
   function reportedStageUrl(res, result) {
     if (!res.derived) return void 0;
@@ -31699,38 +32694,23 @@ function registerStageCommands(program3) {
     const cfg = await loadConfig();
     const reg = registryClientDeps(cfg);
     const slug = slugOf(repo);
-    const read = await fetchProjectBySlugChecked(slug, reg);
-    const decision = decidePortRange({ metaReadOk: read.ok, metaPortRange: read.ok ? metaPortRange(read.project) : null });
-    if (decision.action === "fail") {
-      return failGraceful(`stage port-range: ${decision.reason}${read.ok ? "" : ` (${read.error})`}`);
-    }
-    if (decision.action === "return") {
-      const [start2, end2] = decision.range;
-      printLine(o.json ? JSON.stringify({ repo, portRange: [start2, end2], source: "meta" }) : `${repo}: stage.portRange [${start2}, ${end2}]`);
+    const assigned = await assignPersistedPortRange(repo, slug, reg, { cwd: process.cwd(), moduleDir: __dirname });
+    if (!assigned.ok) return failGraceful(`stage port-range: ${assigned.error}`);
+    const [start, end] = assigned.range;
+    if (assigned.source === "meta") {
+      printLine(o.json ? JSON.stringify({ repo, portRange: [start, end], source: "meta" }) : `${repo}: stage.portRange [${start}, ${end}]`);
       return;
     }
-    const infra = resolvePortRangeInfra(process.cwd(), __dirname);
-    if (!infra) {
-      return failGraceful(
-        `stage port-range: no MMI-Hub allocator files found (checked cwd ${process.cwd()}, sibling MMI-Hub dirs, and the installed package location); ensure the Hub's infra/port-ranges.json and infra/port-ddb.mjs are reachable`
-      );
-    }
-    const path2 = infra.registryPath;
-    const allocate = async (seed) => {
-      const { stdout } = await execFileP2("node", [infra.ddbScriptPath, String(seed)], { timeout: 15e3 });
-      const parsed = JSON.parse(stdout);
-      if (!Array.isArray(parsed.range) || parsed.range.length !== 2) throw new Error("port-ddb: no range in output");
-      return parsed.range;
-    };
-    const { range: [start, end], source } = await ensurePortRangeAtomic(repo, path2, allocate);
-    const write = await upsertProject(slug, { portRange: { start, end } }, reg);
-    if (!write.ok && source === "ddb") {
-      return failGraceful(`stage port-range: block [${start}, ${end}] was allocated (cursor advanced) but NOT recorded in the registry META (${write.error ?? `HTTP ${write.status}`}) \u2014 fix auth/connectivity and retry so the block is persisted; do not re-run blind`);
-    }
     if (o.json) {
-      printLine(JSON.stringify({ repo, portRange: [start, end], source: "allocated", persisted: write.ok, ...write.ok ? {} : { persistError: write.error ?? `HTTP ${write.status}` } }));
+      printLine(JSON.stringify({
+        repo,
+        portRange: [start, end],
+        source: "allocated",
+        persisted: assigned.persisted,
+        ...assigned.persisted ? {} : { persistError: assigned.persistError }
+      }));
     } else {
-      printLine(`${repo}: stage.portRange [${start}, ${end}]${write.ok ? "" : ` (META not persisted: ${write.error ?? `HTTP ${write.status}`})`}`);
+      printLine(`${repo}: stage.portRange [${start}, ${end}]${assigned.persisted ? "" : ` (META not persisted: ${assigned.persistError})`}`);
     }
   });
   async function stageLiveTarget() {
@@ -31816,7 +32796,7 @@ function registerStageCommands(program3) {
       }
     }
     const steps = stageStepsFor(res);
-    if (o.json) return console.log(JSON.stringify({ command: "stage", source: res.source, url: res.derived?.url, registryError: res.registryError, steps }, null, 2));
+    if (o.json) return console.log(JSON.stringify({ command: "stage", ...stageReceiptFields(res), steps }, null, 2));
     console.log(renderSteps("mmi-cli stage: dry-run plan", steps));
   });
   stage.command("stop").description("stop the previous local stage process recorded in tmp/stage/state.json").option("--json", "machine-readable output").option("--apply", "kill the recorded process tree and remove the state file").action(async () => {
@@ -31837,7 +32817,7 @@ function registerStageCommands(program3) {
     const res = await resolveStage();
     if (!o.apply) {
       const steps = stageStepsFor(res, false);
-      if (o.json) return printLine(JSON.stringify({ command: "stage start", source: res.source, url: res.derived?.url, registryError: res.registryError, steps }, null, 2));
+      if (o.json) return printLine(JSON.stringify({ command: "stage start", ...stageReceiptFields(res), steps }, null, 2));
       return printLine(renderSteps("mmi-cli stage start: dry-run plan", steps));
     }
     if (res.source === "none") return failGraceful(`stage start: ${res.gap}`);
@@ -31870,7 +32850,7 @@ function registerStageCommands(program3) {
     const res = await resolveStage();
     if (!o.apply) {
       const steps = stageStepsFor(res);
-      if (o.json) return printLine(JSON.stringify({ command: "stage run", source: res.source, url: res.derived?.url, registryError: res.registryError, steps }, null, 2));
+      if (o.json) return printLine(JSON.stringify({ command: "stage run", ...stageReceiptFields(res), steps }, null, 2));
       return printLine(renderSteps("mmi-cli stage run: dry-run plan", steps));
     }
     if (res.source === "none") return failGraceful(`stage run: ${res.gap}`);
@@ -31902,9 +32882,9 @@ function registerStageCommands(program3) {
 }
 
 // src/merge-cleanup.ts
-var import_node_fs37 = require("node:fs");
-var import_node_path35 = require("node:path");
-var import_node_os16 = require("node:os");
+var import_node_fs40 = require("node:fs");
+var import_node_path37 = require("node:path");
+var import_node_os18 = require("node:os");
 init_cli_shared();
 
 // src/config-load.ts
@@ -32181,13 +33161,13 @@ async function composeOverrideBodyFile(prNumber, repoArgs, gh) {
     const commits = JSON.parse(raw).commits ?? [];
     const body = squashBodyWithOverride(commits.map((c) => ({ headline: c.messageHeadline ?? "", body: c.messageBody ?? "" })), process.cwd());
     if (!body) return void 0;
-    const dir = (0, import_node_fs37.mkdtempSync)((0, import_node_path35.join)((0, import_node_os16.tmpdir)(), "mmi-squash-body-"));
-    const path2 = (0, import_node_path35.join)(dir, "body.txt");
-    (0, import_node_fs37.writeFileSync)(path2, `${body}
+    const dir = (0, import_node_fs40.mkdtempSync)((0, import_node_path37.join)((0, import_node_os18.tmpdir)(), "mmi-squash-body-"));
+    const path2 = (0, import_node_path37.join)(dir, "body.txt");
+    (0, import_node_fs40.writeFileSync)(path2, `${body}
 `, "utf8");
     return { path: path2, cleanup: () => {
       try {
-        (0, import_node_fs37.rmSync)(dir, { recursive: true, force: true });
+        (0, import_node_fs40.rmSync)(dir, { recursive: true, force: true });
       } catch {
       }
     } };
@@ -32394,7 +33374,9 @@ function registerBoardCommands(program3) {
     "Pass raw issue numbers/refs, not URLs.",
     "Claim already assigns and moves Status to In Progress, so do not also board move it.",
     "Multiple refs are handled as a batch and return per-item results.",
-    "--check is the live gate read (it calls GitHub); --dry-run only echoes the parsed argv plan."
+    "--check is the live gate read (it calls GitHub); --dry-run only echoes the parsed argv plan.",
+    // #5552: agents guess `oracle issue claim`; that route does not exist — board claim is the only write.
+    "Never run `oracle issue claim` \u2014 claims are board mutations; only `oracle board claim <ref>` is valid."
   ]);
   board.command("show <issue>").description("print one board item (status, assignees, type, url) with its body and comments").option("--json", "machine-readable output").option("--repo <owner/repo>", "current repo for local issue numbers (defaults to git origin)").option("--allow-partial", "return the item even if its body/comments fetch fails").action(async (issueRef, o) => {
     try {
@@ -32683,18 +33665,33 @@ var PR_SNAPSHOT_READ_RETRIES = 3;
 var PR_SNAPSHOT_READ_DELAY_MS = 2e3;
 async function readRestPrSnapshotWithRetry(prNumber, repo, gh = defaultGhApi, options) {
   const retries = options?.retries ?? PR_SNAPSHOT_READ_RETRIES;
-  const delayMs = options?.delayMs ?? PR_SNAPSHOT_READ_DELAY_MS;
-  const sleep2 = options?.sleep ?? ((ms) => new Promise((resolve5) => setTimeout(resolve5, ms)));
+  const untilMs = options?.retryTransientUntilMs;
+  const delayMs = options?.delayMs ?? (untilMs !== void 0 ? PR_CHECKS_POLL_MS : PR_SNAPSHOT_READ_DELAY_MS);
+  const sleep2 = options?.sleep ?? ((ms) => new Promise((resolve6) => setTimeout(resolve6, ms)));
+  const now = options?.now ?? (() => Date.now());
   let lastError = "no attempt completed";
-  for (let attempt = 0; attempt < retries; attempt++) {
+  let attempt = 0;
+  for (; ; ) {
     try {
       return { state: "ok", snapshot: await fetchRestPrSnapshot(prNumber, repo, gh) };
     } catch (e) {
       lastError = readErrorText(e);
+      attempt += 1;
+      const retryable = isRetryableGitHubWaitReadError(e);
+      if (!retryable) {
+        return { state: "failed", error: `pulls read failed for #${prNumber} on ${repo}: ${lastError}` };
+      }
+      const canRetry = untilMs !== void 0 ? now() + delayMs < untilMs : attempt < retries;
+      if (!canRetry) {
+        return {
+          state: "failed",
+          error: `pulls read failed for #${prNumber} on ${repo} after ${attempt} attempts: ${lastError}`
+        };
+      }
+      options?.onTransientRetry?.(lastError, attempt);
+      await sleep2(delayMs);
     }
-    if (attempt < retries - 1) await sleep2(delayMs);
   }
-  return { state: "failed", error: `pulls read failed for #${prNumber} on ${repo} after ${retries} attempts: ${lastError}` };
 }
 async function fetchRestClosingGuardPayload(prNumber, repo, gh = defaultGhApi) {
   const pr2 = JSON.parse(await gh([`repos/${repo}/pulls/${prNumber}`]));
@@ -32984,8 +33981,8 @@ async function checkDocsIndexAtHead(opts, deps) {
 }
 
 // src/issue-commands.ts
-var import_node_fs38 = require("node:fs");
-var import_node_crypto14 = require("node:crypto");
+var import_node_fs41 = require("node:fs");
+var import_node_crypto16 = require("node:crypto");
 init_cli_shared();
 init_clean_exit();
 init_error_codes();
@@ -33177,7 +34174,7 @@ async function editIssue(client, options, deps = {}) {
   const url = `https://github.com/${repo}/issues/${parsed.number}`;
   const patch = {};
   let bodyChanged = false;
-  const textDeps = () => deps.textDeps ?? { readFile: (p, e) => Promise.resolve((0, import_node_fs38.readFileSync)(p, e)), readStdin: () => Promise.resolve("") };
+  const textDeps = () => deps.textDeps ?? { readFile: (p, e) => Promise.resolve((0, import_node_fs41.readFileSync)(p, e)), readStdin: () => Promise.resolve("") };
   if (options.titleFile !== void 0) {
     patch.title = await resolveIssueTitle({ title: options.title, titleFile: options.titleFile }, textDeps());
   } else if (options.title !== void 0) {
@@ -33458,7 +34455,7 @@ function rowIdempotencyKey(batchKey, spec) {
   const identity = `${spec.type}
 ${spec.title.trim()}
 ${spec.body ?? ""}`;
-  const hash = (0, import_node_crypto14.createHash)("sha256").update(identity).digest("hex").slice(0, 16);
+  const hash = (0, import_node_crypto16.createHash)("sha256").update(identity).digest("hex").slice(0, 16);
   return `${batchKey}:${hash}`;
 }
 var BATCH_SPEC_KEYS = /* @__PURE__ */ new Set(["type", "title", "body", "priority", "labels", "label", "parent", "repo", "surface"]);
@@ -33794,7 +34791,7 @@ function extendCreateCommand(issue2, batchAttach) {
     if (opts.batch) {
       let specs;
       try {
-        const raw = (0, import_node_fs38.readFileSync)(opts.batch, "utf8");
+        const raw = (0, import_node_fs41.readFileSync)(opts.batch, "utf8");
         specs = JSON.parse(raw);
         if (!Array.isArray(specs)) throw new Error("batch file must contain a JSON array");
       } catch (e) {
@@ -33869,8 +34866,8 @@ ${lines}`, {
 }
 
 // src/train-commands.ts
-var import_node_fs39 = require("node:fs");
-var import_node_path36 = require("node:path");
+var import_node_fs42 = require("node:fs");
+var import_node_path38 = require("node:path");
 init_cli_shared();
 init_clean_exit();
 init_client_version();
@@ -33885,7 +34882,7 @@ function resolveReleaseBumpIntent(raw) {
 }
 function readRepoVersion() {
   try {
-    return JSON.parse((0, import_node_fs39.readFileSync)((0, import_node_path36.join)(process.cwd(), ".claude-plugin", "plugin.json"), "utf8")).version || void 0;
+    return JSON.parse((0, import_node_fs42.readFileSync)((0, import_node_path38.join)(process.cwd(), ".claude-plugin", "plugin.json"), "utf8")).version || void 0;
   } catch {
     return void 0;
   }
@@ -34049,9 +35046,9 @@ function registerDeployCommands(program3) {
 init_cli_shared();
 init_github_client();
 init_cli_shared();
-var import_node_fs40 = require("node:fs");
-var import_node_os17 = require("node:os");
-var import_node_path37 = require("node:path");
+var import_node_fs43 = require("node:fs");
+var import_node_os19 = require("node:os");
+var import_node_path39 = require("node:path");
 init_marketplace_autoupdate();
 var GC_GH_TIMEOUT_MS2 = 2e4;
 async function collectStatus() {
@@ -34170,7 +35167,7 @@ function onboardPluginGate(deps) {
     declared,
     settingsDeclared: readSettingsAutoUpdate(deps.readSettings(), MMI_MARKETPLACE_NAME)
   }).effective;
-  return autoUpdate ? { ok: false, detail: "background auto-update is ON \u2014 duplicate writer; run `mmi-hub update` outside Claude Code to disable it" } : { ok: true, detail: "background auto-update off; mmi-hub is the single release-gated writer" };
+  return autoUpdate ? { ok: true, detail: "background auto-update on \u2014 org pin; thin catalog is release-gated" } : { ok: false, detail: "background auto-update is OFF \u2014 this machine will not pick up a new plugin release on its own; run `mmi-cli doctor` to pin it on" };
 }
 async function collectOnboardStatus(opts = {}) {
   const cfg = await loadConfig();
@@ -34252,10 +35249,10 @@ async function collectOnboardStatus(opts = {}) {
     else if (top) nextCommand = `mmi-cli oracle board claim ${top.number}  # ${top.title}`;
     else nextCommand = "mmi-cli oracle board read \u2014 no claimable items found";
   }
-  const home = (0, import_node_os17.homedir)();
+  const home = (0, import_node_os19.homedir)();
   const plugin = onboardPluginGate({
-    readKnown: () => readFileSyncSafe((0, import_node_path37.join)(home, ...KNOWN_MARKETPLACES_RELATIVE), import_node_fs40.readFileSync),
-    readSettings: () => readFileSyncSafe((0, import_node_path37.join)(home, ".claude", "settings.json"), import_node_fs40.readFileSync)
+    readKnown: () => readFileSyncSafe((0, import_node_path39.join)(home, ...KNOWN_MARKETPLACES_RELATIVE), import_node_fs43.readFileSync),
+    readSettings: () => readFileSyncSafe((0, import_node_path39.join)(home, ".claude", "settings.json"), import_node_fs43.readFileSync)
   });
   return { track, board, registry: registry2, secrets, plugin, estateCli, doors: opts.doors ?? [], nextCommand };
 }
@@ -34338,12 +35335,17 @@ var LOOP_PLAYBOOKS = {
       { label: "Orient in the current repository", command: "mmi-cli onboard" },
       { label: "Structure search: `find` is semantic default; `repo-index search` is hybrid. Cloud default (`--local` is checkout-only); verify repo/commit/path/lines and result retrieval metadata; status is runtime authority", command: "mmi-cli oracle find <q>" },
       { label: "Read the next board item", command: "mmi-cli oracle board read" },
+      // #5552: claim is a board mutation only — never guess `oracle issue claim`. Ground unknown write
+      // routes with `mmi-cli commands` / `mmi-cli explain` before invoking them.
+      { label: "Claim board work (board mutation only \u2014 never `oracle issue claim`; ground unknown write routes via `commands` / `explain` first)", command: "mmi-cli oracle board claim <ref>" },
       { label: "Prepare the local workspace through the host surface" },
       { label: "Apply the repository test policy, then build the touched package", command: "mmi-cli tests policy --base origin/development && npm run build" },
       { label: "Publish the branch", command: "git push origin <branch>:<branch>" },
       { label: "Open the development-base PR", command: 'mmi-cli devops pr create --title "<title>" --body-file .jerv/PR_BODY.md --base development' },
       { label: "Wait for checks and land to development", command: "mmi-cli devops pr checks-wait <PR-number> && mmi-cli devops pr land <PR-number>" },
-      { label: "Release only after the gated train is authorized", command: "mmi-cli devops release --apply" }
+      { label: "Release only after the gated train is authorized", command: "mmi-cli devops release --apply" },
+      // #5552: learning-tagged filings are cloud-agent owned — file and return to the current task.
+      { label: "Learning reports are fire-and-forget (file, then return to the current task \u2014 never claim/poll/duplicate the learning issue)", command: 'mmi-cli learning report --title "<one-line>" --body "<what hurt>"' }
     ]
   },
   "start-work": {
@@ -34351,6 +35353,7 @@ var LOOP_PLAYBOOKS = {
     steps: [
       { label: "Orient in the current repository", command: "mmi-cli onboard" },
       { label: "Read the board item", command: "mmi-cli oracle board show <issue-number>" },
+      { label: "Claim the item (board mutation only \u2014 never `oracle issue claim`)", command: "mmi-cli oracle board claim <issue-number>" },
       { label: "Prepare the local workspace through the host surface" },
       { label: "Start a local stage (deployable repos)", command: "mmi-cli stage run --apply" }
     ]
@@ -34968,8 +35971,8 @@ function registerPrLifecycleCommands(program3) {
 }
 
 // src/post-merge-recon.ts
-var import_node_fs41 = require("node:fs");
-var import_node_path38 = require("node:path");
+var import_node_fs44 = require("node:fs");
+var import_node_path40 = require("node:path");
 
 // src/cross-repo-filing-issue.ts
 init_github_client();
@@ -35136,16 +36139,16 @@ function buildPostMergeReconRecovery(input) {
 }
 function writePostMergeReconRecovery(cwd, recovery) {
   const path2 = postMergeReconStatePath(cwd, recovery.repo, recovery.pr);
-  (0, import_node_fs41.mkdirSync)((0, import_node_path38.dirname)(path2), { recursive: true });
-  (0, import_node_fs41.writeFileSync)(path2, `${JSON.stringify(recovery, null, 2)}
+  (0, import_node_fs44.mkdirSync)((0, import_node_path40.dirname)(path2), { recursive: true });
+  (0, import_node_fs44.writeFileSync)(path2, `${JSON.stringify(recovery, null, 2)}
 `, "utf8");
   return path2;
 }
 function clearPostMergeReconRecovery(cwd, repo, pr2) {
   const path2 = postMergeReconStatePath(cwd, repo, pr2);
-  if (!(0, import_node_fs41.existsSync)(path2)) return;
+  if (!(0, import_node_fs44.existsSync)(path2)) return;
   try {
-    (0, import_node_fs41.unlinkSync)(path2);
+    (0, import_node_fs44.unlinkSync)(path2);
   } catch {
   }
 }
@@ -35568,6 +36571,7 @@ var surfaces_default = {
             targetPath: "packages/claude-plugin/scripts",
             include: [
               "pretooluse-shell-gates.mjs",
+              "test-command-policy-core.mjs",
               "vault-edit-gate.mjs",
               "deny-gate-crash.mjs",
               "secret-echo-lint.mjs",
@@ -35694,6 +36698,7 @@ var surfaces_default = {
             targetPath: "packages/codex-plugin/scripts",
             include: [
               "pretooluse-shell-gates.mjs",
+              "test-command-policy-core.mjs",
               "vault-edit-gate.mjs",
               "deny-gate-crash.mjs",
               "secret-echo-lint.mjs",
@@ -35812,6 +36817,7 @@ var surfaces_default = {
             targetPath: "packages/kimi-plugin/scripts",
             include: [
               "pretooluse-shell-gates.mjs",
+              "test-command-policy-core.mjs",
               "vault-edit-gate.mjs",
               "deny-gate-crash.mjs",
               "secret-echo-lint.mjs",
@@ -35938,6 +36944,7 @@ var surfaces_default = {
             targetPath: "packages/cursor-plugin/scripts",
             include: [
               "pretooluse-shell-gates.mjs",
+              "test-command-policy-core.mjs",
               "vault-edit-gate.mjs",
               "deny-gate-crash.mjs",
               "secret-echo-lint.mjs",
@@ -36060,6 +37067,7 @@ var surfaces_default = {
             targetPath: ".kilo-plugin/scripts",
             include: [
               "pretooluse-shell-gates.mjs",
+              "test-command-policy-core.mjs",
               "vault-edit-gate.mjs",
               "deny-gate-crash.mjs",
               "secret-echo-lint.mjs",
@@ -36169,6 +37177,7 @@ var surfaces_default = {
             targetPath: ".pi-plugin/scripts",
             include: [
               "pretooluse-shell-gates.mjs",
+              "test-command-policy-core.mjs",
               "vault-edit-gate.mjs",
               "deny-gate-crash.mjs",
               "secret-echo-lint.mjs",
@@ -36268,6 +37277,7 @@ var surfaces_default = {
             targetPath: "packages/hermes-plugin/scripts",
             include: [
               "pretooluse-shell-gates.mjs",
+              "test-command-policy-core.mjs",
               "vault-edit-gate.mjs",
               "deny-gate-crash.mjs",
               "secret-echo-lint.mjs",
@@ -36957,7 +37967,8 @@ function diagnoseSurface(evidence) {
   const base = {
     descriptor: evidence.descriptor,
     ...evidence.installedVersion ? { installedVersion: evidence.installedVersion } : {},
-    ...evidence.releasedVersion ? { releasedVersion: evidence.releasedVersion } : {}
+    ...evidence.releasedVersion ? { releasedVersion: evidence.releasedVersion } : {},
+    ...evidence.receipt ? { receipt: evidence.receipt } : {}
   };
   if (!evidence.applicable) return { ...base, state: "skipped" };
   if (evidence.repair?.attempted && !evidence.repair.ok) {
@@ -37047,6 +38058,7 @@ function buildSurfaceDoctorCheck(diagnosis) {
       `install: ${descriptor.installMechanism} (${descriptor.installLocator})`,
       `repair owner: ${descriptor.repairOwner}`,
       `artifacts: ${descriptor.artifactIds.join(", ")}`,
+      ...diagnosis.receipt ? [`receipt: ${diagnosis.receipt}`] : [],
       ...diagnosis.repairDetail ? [`heal: ${diagnosis.repairDetail}`] : []
     ]
   };
@@ -38262,18 +39274,18 @@ function parseOriginRepo(remoteUrl) {
   return `${match[1]}/${match[2]}`;
 }
 function ghHostsConfigPath(env, platform2) {
-  const sep3 = platform2 === "win32" ? "\\" : "/";
-  const join35 = (...parts) => parts.join(sep3);
+  const sep4 = platform2 === "win32" ? "\\" : "/";
+  const join36 = (...parts) => parts.join(sep4);
   const explicit = env.GH_CONFIG_DIR?.trim();
-  if (explicit) return join35(explicit, "hosts.yml");
+  if (explicit) return join36(explicit, "hosts.yml");
   if (platform2 === "win32") {
     const appData = (env.AppData ?? env.APPDATA)?.trim();
-    return appData ? join35(appData, "GitHub CLI", "hosts.yml") : void 0;
+    return appData ? join36(appData, "GitHub CLI", "hosts.yml") : void 0;
   }
   const xdg = env.XDG_CONFIG_HOME?.trim();
-  if (xdg) return join35(xdg, "gh", "hosts.yml");
+  if (xdg) return join36(xdg, "gh", "hosts.yml");
   const home = env.HOME?.trim();
-  return home ? join35(home, ".config", "gh", "hosts.yml") : void 0;
+  return home ? join36(home, ".config", "gh", "hosts.yml") : void 0;
 }
 function parseGhHostsAccounts(yaml, host = "github.com") {
   let hostIndent = null;
@@ -38323,19 +39335,41 @@ function ghAccountCaveat(announcedLogin, accounts) {
 }
 
 // src/doctor-io.ts
-var import_node_fs42 = require("node:fs");
-var import_node_os18 = require("node:os");
-var import_node_path39 = require("node:path");
-var import_node_child_process19 = require("node:child_process");
+var import_node_fs45 = require("node:fs");
+var import_node_os20 = require("node:os");
+var import_node_path41 = require("node:path");
+var import_node_child_process20 = require("node:child_process");
 var import_node_util8 = require("node:util");
 init_version_lag();
 init_plugin_guard_io();
-var execFileP6 = (0, import_node_util8.promisify)(import_node_child_process19.execFile);
+
+// src/discard-sink.ts
+function nodeDiscardSinkPath(platform2 = process.platform) {
+  return platform2 === "win32" ? "\\\\.\\NUL" : "/dev/null";
+}
+
+// src/doctor-io.ts
+var execFileP6 = (0, import_node_util8.promisify)(import_node_child_process20.execFile);
+function execFileCapture(file, args, opts = {}) {
+  const sink = nodeDiscardSinkPath();
+  const inFd = (0, import_node_fs45.openSync)(sink, "r");
+  const errFd = (0, import_node_fs45.openSync)(sink, "w");
+  try {
+    return (0, import_node_child_process20.execFileSync)(file, args, {
+      ...opts,
+      encoding: "utf8",
+      stdio: [inFd, "pipe", errFd]
+    });
+  } finally {
+    (0, import_node_fs45.closeSync)(inFd);
+    (0, import_node_fs45.closeSync)(errFd);
+  }
+}
 var MMI_PLUGIN_ID2 = "mmi@mutmutco";
 function installedClaudePluginVersion() {
   try {
     const file = JSON.parse(
-      (0, import_node_fs42.readFileSync)((0, import_node_path39.join)((0, import_node_os18.homedir)(), ".claude", "plugins", "installed_plugins.json"), "utf8")
+      (0, import_node_fs45.readFileSync)((0, import_node_path41.join)((0, import_node_os20.homedir)(), ".claude", "plugins", "installed_plugins.json"), "utf8")
     );
     const versions = (file.plugins?.[MMI_PLUGIN_ID2] ?? []).map((r) => r.version).filter((v) => Boolean(v));
     if (versions.length === 0) return void 0;
@@ -38346,7 +39380,7 @@ function installedClaudePluginVersion() {
 }
 function manifestVersion(path2) {
   try {
-    const manifest = JSON.parse((0, import_node_fs42.readFileSync)(path2, "utf8"));
+    const manifest = JSON.parse((0, import_node_fs45.readFileSync)(path2, "utf8"));
     return typeof manifest.version === "string" && manifest.version.trim() ? manifest.version.trim() : void 0;
   } catch {
     return void 0;
@@ -38355,12 +39389,12 @@ function manifestVersion(path2) {
 function readHermesPluginEvidence(env = process.env) {
   const host = hermesConfigRoot(env);
   const root = hermesPluginRoot(env);
-  const installRecordPresent = (0, import_node_fs42.existsSync)(root);
-  const manifestPath = (0, import_node_path39.join)(root, "plugin.yaml");
+  const installRecordPresent = (0, import_node_fs45.existsSync)(root);
+  const manifestPath = (0, import_node_path41.join)(root, "plugin.yaml");
   let installedVersion;
   let manifest = "missing";
   try {
-    const text = (0, import_node_fs42.readFileSync)(manifestPath, "utf8");
+    const text = (0, import_node_fs45.readFileSync)(manifestPath, "utf8");
     let version;
     try {
       const parsed = JSON.parse(text).version;
@@ -38374,20 +39408,20 @@ function readHermesPluginEvidence(env = process.env) {
     if (version) {
       installedVersion = version;
       manifest = "valid";
-    } else if ((0, import_node_fs42.existsSync)(manifestPath)) manifest = "invalid";
+    } else if ((0, import_node_fs45.existsSync)(manifestPath)) manifest = "invalid";
   } catch {
-    if ((0, import_node_fs42.existsSync)(manifestPath)) manifest = "invalid";
+    if ((0, import_node_fs45.existsSync)(manifestPath)) manifest = "invalid";
   }
   let skills = false;
   try {
-    skills = (0, import_node_fs42.existsSync)((0, import_node_path39.join)(root, "skills")) && (0, import_node_fs42.statSync)((0, import_node_path39.join)(root, "skills")).isDirectory();
+    skills = (0, import_node_fs45.existsSync)((0, import_node_path41.join)(root, "skills")) && (0, import_node_fs45.statSync)((0, import_node_path41.join)(root, "skills")).isDirectory();
   } catch {
   }
   return {
-    hostPresent: (0, import_node_fs42.existsSync)(host),
+    hostPresent: (0, import_node_fs45.existsSync)(host),
     installRecordPresent,
     manifest,
-    payloadPresent: (0, import_node_fs42.existsSync)((0, import_node_path39.join)(root, "__init__.py")) && skills && manifest === "valid",
+    payloadPresent: (0, import_node_fs45.existsSync)((0, import_node_path41.join)(root, "__init__.py")) && skills && manifest === "valid",
     ...installedVersion ? { installedVersion } : {}
   };
 }
@@ -38395,7 +39429,7 @@ function installedSurfacePluginVersion(surface) {
   const token = surfaceToken(surface);
   if (token === "kilo") {
     try {
-      const stamp = (0, import_node_fs42.readFileSync)((0, import_node_path39.join)((0, import_node_os18.homedir)(), ".kilo", ".mmi-kilo-version"), "utf8").trim();
+      const stamp = (0, import_node_fs45.readFileSync)((0, import_node_path41.join)((0, import_node_os20.homedir)(), ".kilo", ".mmi-kilo-version"), "utf8").trim();
       return stamp || void 0;
     } catch {
       return void 0;
@@ -38403,25 +39437,21 @@ function installedSurfacePluginVersion(surface) {
   }
   if (token === "hermes") return readHermesPluginEvidence().installedVersion;
   if (token === "cursor") {
-    return manifestVersion((0, import_node_path39.join)(cursorLocalPluginRoot(), ".cursor-plugin", "plugin.json"));
+    return manifestVersion((0, import_node_path41.join)(cursorLocalPluginRoot(), ".cursor-plugin", "plugin.json"));
   }
   if (token === "jervcode") {
     return installedJervCodePackageVersion();
   }
   if (token === "kimi") {
-    return manifestVersion((0, import_node_path39.join)(surfaceConfigRoot(surface), "plugins", "managed", "mmi", ".kimi-plugin", "plugin.json"));
+    return manifestVersion((0, import_node_path41.join)(surfaceConfigRoot(surface), "plugins", "managed", "mmi", ".kimi-plugin", "plugin.json"));
   }
   if (token === "claude") return installedClaudePluginVersion();
   if (token !== "codex") return void 0;
   try {
-    const raw = process.platform === "win32" ? (0, import_node_child_process19.execFileSync)("cmd.exe", ["/c", "codex", "plugin", "list", "--json"], {
-      encoding: "utf8",
-      stdio: ["ignore", "pipe", "ignore"],
+    const raw = process.platform === "win32" ? execFileCapture("cmd.exe", ["/c", "codex", "plugin", "list", "--json"], {
       timeout: 15e3,
       windowsHide: true
-    }) : (0, import_node_child_process19.execFileSync)("codex", ["plugin", "list", "--json"], {
-      encoding: "utf8",
-      stdio: ["ignore", "pipe", "ignore"],
+    }) : execFileCapture("codex", ["plugin", "list", "--json"], {
       timeout: 15e3,
       windowsHide: true
     });
@@ -38437,7 +39467,7 @@ function installedActivePluginVersion(surface = detectSurface(process.env)) {
 }
 function worktreeRootSync() {
   try {
-    const out = (0, import_node_child_process19.execFileSync)("git", ["rev-parse", "--show-toplevel"], { windowsHide: true, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] });
+    const out = execFileCapture("git", ["rev-parse", "--show-toplevel"], { windowsHide: true });
     let root = out.endsWith("\n") ? out.slice(0, -1) : out;
     if (process.platform === "win32" && root.endsWith("\r")) root = root.slice(0, -1);
     return root || null;
@@ -38447,13 +39477,13 @@ function worktreeRootSync() {
 }
 var gitignorePath = () => {
   const root = worktreeRootSync();
-  return root === null ? null : (0, import_node_path39.join)(root, ".gitignore");
+  return root === null ? null : (0, import_node_path41.join)(root, ".gitignore");
 };
 function readGitignore() {
   const path2 = gitignorePath();
   if (path2 === null) return null;
   try {
-    return (0, import_node_fs42.readFileSync)(path2, "utf8");
+    return (0, import_node_fs45.readFileSync)(path2, "utf8");
   } catch {
     return null;
   }
@@ -38462,19 +39492,17 @@ function writeGitignore(content) {
   const path2 = gitignorePath();
   if (path2 === null) return false;
   try {
-    (0, import_node_fs42.writeFileSync)(path2, content, "utf8");
+    (0, import_node_fs45.writeFileSync)(path2, content, "utf8");
     return true;
   } catch {
     return false;
   }
 }
 function lineEndingState(root) {
-  const attributesPresent = (0, import_node_fs42.existsSync)((0, import_node_path39.join)(root, ".gitattributes"));
+  const attributesPresent = (0, import_node_fs45.existsSync)((0, import_node_path41.join)(root, ".gitattributes"));
   try {
-    const output = (0, import_node_child_process19.execFileSync)("git", ["-C", root, "ls-files", "--eol", "--", ":(glob)**/*.sh"], {
-      windowsHide: true,
-      encoding: "utf8",
-      stdio: ["ignore", "pipe", "ignore"]
+    const output = execFileCapture("git", ["-C", root, "ls-files", "--eol", "--", ":(glob)**/*.sh"], {
+      windowsHide: true
     });
     const crlfShellScripts = output.split(/\r?\n/).filter((line) => line.startsWith("i/crlf ")).map((line) => line.slice(line.indexOf("	") + 1)).filter(Boolean);
     return { attributesPresent, crlfShellScripts };
@@ -38538,8 +39566,8 @@ ${r.stderr ?? ""}`).catch(() => "");
 function ghMultiAccountCaveat(announcedLogin) {
   try {
     const hostsPath = ghHostsConfigPath(process.env, process.platform);
-    if (!hostsPath || !(0, import_node_fs43.existsSync)(hostsPath)) return void 0;
-    return ghAccountCaveat(announcedLogin, parseGhHostsAccounts((0, import_node_fs43.readFileSync)(hostsPath, "utf8")));
+    if (!hostsPath || !(0, import_node_fs46.existsSync)(hostsPath)) return void 0;
+    return ghAccountCaveat(announcedLogin, parseGhHostsAccounts((0, import_node_fs46.readFileSync)(hostsPath, "utf8")));
   } catch {
     return void 0;
   }
@@ -38547,12 +39575,12 @@ function ghMultiAccountCaveat(announcedLogin) {
 var ENV_HEAL_LOCK_STALE_MS = 10 * 6e4;
 var ENV_HEAL_LOCK_MAX_WAIT_MS = 2 * 6e4;
 function envHealLockPath(home) {
-  return (0, import_node_path40.join)(home, ".claude", "plugins", ".mmi-env-heal.lock");
+  return (0, import_node_path42.join)(home, ".claude", "plugins", ".mmi-env-heal.lock");
 }
 async function withEnvHealLock(what, run) {
   try {
     return await withFileLock(
-      envHealLockPath((0, import_node_os19.homedir)()),
+      envHealLockPath((0, import_node_os21.homedir)()),
       { staleMs: ENV_HEAL_LOCK_STALE_MS, maxWaitMs: ENV_HEAL_LOCK_MAX_WAIT_MS, label: "mmi env-heal lock" },
       run
     );
@@ -38594,17 +39622,19 @@ function mmiDoctorDeps(opts = {}) {
     const descriptor = doctorSurface(token);
     const snapshot = snapshotPluginGuardInput(runtimeSurface, isOrgRepo);
     const hermes = token === "hermes" ? readHermesPluginEvidence(process.env) : void 0;
+    const kimi = token === "kimi" ? kimiPluginHostEvidence(surfaceConfigRoot("kimi")) : void 0;
     const installedVersion = hermes?.installedVersion ?? installedSurfacePluginVersion(runtimeSurface);
     surfaceEvidence = {
       descriptor,
       // Hermes' root is the host evidence: a configured but uninstalled MMI tree is missing, while an
       // absent root is skipped. Other mature surfaces retain their established org/install applicability.
       applicable: hermes ? hermes.hostPresent : isOrgRepo || snapshot.installRecordPresent || snapshot.pluginCachePresent,
-      installRecordPresent: hermes?.installRecordPresent ?? snapshot.installRecordPresent,
+      installRecordPresent: hermes?.installRecordPresent ?? (kimi ? kimi.registration === "healthy" : snapshot.installRecordPresent),
       deliveryPresent: hermes ? hermes.installRecordPresent : snapshot.marketplaceClonePresent,
-      payloadPresent: hermes?.payloadPresent ?? snapshot.pluginCachePresent,
+      payloadPresent: hermes?.payloadPresent ?? (kimi ? kimi.healthy : snapshot.pluginCachePresent),
       manifest: hermes?.manifest ?? (installedVersion ? "valid" : snapshot.installRecordPresent ? "invalid" : "missing"),
       guardState: buildPluginGuardDecision(snapshot).state,
+      ...kimi?.receipt ? { receipt: kimi.receipt } : {},
       ...installedVersion ? { installedVersion } : {}
     };
     return surfaceEvidence;
@@ -38647,7 +39677,7 @@ function mmiDoctorDeps(opts = {}) {
       const configRoot = surfaceConfigRoot(surface);
       const running = surface === "codex" ? installedActivePluginVersion(surface) : runningPluginVersion(process.env, resolveClientVersion());
       const plan = buildPluginCachePlan(
-        (0, import_node_os19.homedir)(),
+        (0, import_node_os21.homedir)(),
         running,
         pluginCacheFsDeps(configRoot, () => 0),
         { configRoot, includeStaging: surface !== "codex" }
@@ -38675,14 +39705,14 @@ function mmiDoctorDeps(opts = {}) {
       const running = surface === "codex" ? installedActivePluginVersion(surface) : runningPluginVersion(process.env, resolveClientVersion());
       const installed = installedActivePluginVersion(surface);
       const plan = buildPluginCachePlan(
-        (0, import_node_os19.homedir)(),
+        (0, import_node_os21.homedir)(),
         running,
         pluginCacheFsDeps(configRoot, () => 0),
         { configRoot, includeStaging: surface !== "codex", installedVersion: installed }
       );
       const result = applyPluginCachePlan(
         plan,
-        (p) => (0, import_node_fs43.rmSync)(p, { recursive: true }),
+        (p) => (0, import_node_fs46.rmSync)(p, { recursive: true }),
         stagingApplyFsGuard(configRoot)
       );
       return {
@@ -38720,7 +39750,7 @@ function mmiDoctorDeps(opts = {}) {
     // adopted the generated routing index (MMG-Unlive: `docs/Archive/**` only, no index, no gate.yml) would
     // get a permanent — demanding an artifact it never asked for.
     docsIndexState: (root) => {
-      if (!(0, import_node_fs43.existsSync)((0, import_node_path40.join)(root, DOCS_INDEX_PATH))) return void 0;
+      if (!(0, import_node_fs46.existsSync)((0, import_node_path42.join)(root, DOCS_INDEX_PATH))) return void 0;
       const real = createDocsIndexDeps(root);
       let docs2;
       const listDocs = () => docs2 ??= real.listDocs();
@@ -38729,7 +39759,7 @@ function mmiDoctorDeps(opts = {}) {
     },
     // #4168: working-tree heal — write if drifted, then re-check. Commit remains the operator's step.
     healDocsIndex: (root) => {
-      if (!(0, import_node_fs43.existsSync)((0, import_node_path40.join)(root, DOCS_INDEX_PATH))) return { drift: false, docCount: 0 };
+      if (!(0, import_node_fs46.existsSync)((0, import_node_path42.join)(root, DOCS_INDEX_PATH))) return { drift: false, docCount: 0 };
       const real = createDocsIndexDeps(root);
       let docs2;
       const listDocs = () => docs2 ??= real.listDocs();
@@ -38750,8 +39780,8 @@ function mmiDoctorDeps(opts = {}) {
         });
         const raced = await Promise.race([
           work.then((r) => ({ ...r, timedOut: false })),
-          new Promise((resolve5) => {
-            ceiling = setTimeout(() => resolve5({ timedOut: true, scanned: 0, findings: 0, fixed: 0, failed: 0 }), BOARD_DOCTOR_TIMEOUT_MS);
+          new Promise((resolve6) => {
+            ceiling = setTimeout(() => resolve6({ timedOut: true, scanned: 0, findings: 0, fixed: 0, failed: 0 }), BOARD_DOCTOR_TIMEOUT_MS);
           })
         ]);
         if (raced.timedOut) return { scanned: 0, findings: 0, fixed: 0, failed: 0, timedOut: true };
@@ -38784,8 +39814,8 @@ function mmiDoctorDeps(opts = {}) {
             incomplete: nb.incomplete,
             timedOut: false
           })),
-          new Promise((resolve5) => {
-            ceiling = setTimeout(() => resolve5({ driftLines: [], incomplete: [], timedOut: true }), SCHEDULES_DRIFT_TIMEOUT_MS);
+          new Promise((resolve6) => {
+            ceiling = setTimeout(() => resolve6({ driftLines: [], incomplete: [], timedOut: true }), SCHEDULES_DRIFT_TIMEOUT_MS);
           })
         ]);
         if (!raced.timedOut && raced.incomplete.length === 0) writeSchedulesDriftCache(cachePath, raced.driftLines);
@@ -38821,7 +39851,7 @@ function mmiDoctorDeps(opts = {}) {
     repoIndexCloudState: async (root) => {
       let localV4 = { state: "absent" };
       try {
-        const parsed = JSON.parse((0, import_node_fs43.readFileSync)(repoIndexV4StorePath(root), "utf8"));
+        const parsed = JSON.parse((0, import_node_fs46.readFileSync)(repoIndexV4StorePath(root), "utf8"));
         const state = parsed.status?.state;
         if (parsed.schemaVersion === 4 && (state === "ready" || state === "degraded")) {
           const chunks = parsed.manifest?.chunks?.length ?? 0;
@@ -39114,19 +40144,19 @@ program2.hook("preAction", async (_thisCommand, actionCommand) => {
 });
 var rules = program2.command("rules").description("org-managed .gitignore delivery");
 rules.command("gitignore").option("--write", "upsert the managed block into .gitignore (default: check only, non-zero exit on drift)").option("--json", "machine-readable output").description("verify (or --write) this repo's org-managed .gitignore block matches the SSOT").action((opts) => {
-  const path2 = (0, import_node_path40.join)(process.cwd(), ".gitignore");
-  const current = (0, import_node_fs43.existsSync)(path2) ? (0, import_node_fs43.readFileSync)(path2, "utf8") : null;
+  const path2 = (0, import_node_path42.join)(process.cwd(), ".gitignore");
+  const current = (0, import_node_fs46.existsSync)(path2) ? (0, import_node_fs46.readFileSync)(path2, "utf8") : null;
   const plan = planManagedGitignore(current);
   const drift = [...plan.added.map((l) => `+${l}`), ...plan.removed.map((l) => `-${l}`)].join(", ") || "block normalize";
   if (opts.json) {
-    if (opts.write && plan.changed) (0, import_node_fs43.writeFileSync)(path2, plan.content, "utf8");
+    if (opts.write && plan.changed) (0, import_node_fs46.writeFileSync)(path2, plan.content, "utf8");
     console.log(JSON.stringify(plan, null, 2));
     if (!opts.write && plan.changed) process.exitCode = 1;
     return;
   }
   if (opts.write) {
     if (plan.changed) {
-      (0, import_node_fs43.writeFileSync)(path2, plan.content, "utf8");
+      (0, import_node_fs46.writeFileSync)(path2, plan.content, "utf8");
       console.log(`mmi-cli devops org rules gitignore: updated .gitignore (${drift})`);
     } else {
       console.log("mmi-cli devops org rules gitignore: up to date");
@@ -39312,7 +40342,7 @@ function scheduleRelatedDiscovery(o) {
   try {
     const args = ["issue", "discover-related", "--number", String(o.number), "--title", o.title, "--body", o.body, "--fail-soft"];
     if (o.repo) args.push("--repo", o.repo);
-    spawnDetachedSelf(args, { spawn: import_node_child_process20.spawn, execPath: process.execPath, scriptPath: process.argv[1] }, { cwd: process.cwd() });
+    spawnDetachedSelf(args, { spawn: import_node_child_process21.spawn, execPath: process.execPath, scriptPath: process.argv[1] }, { cwd: process.cwd() });
   } catch {
   }
 }
@@ -39553,7 +40583,15 @@ repoIndex.command("gc").description("remove v4 cloud authority material for repo
       consoleIo.log(JSON.stringify(res, null, 2));
       return;
     }
-    console.log(`repo-index: gc removed ${res.removed.length} orphan v4 authority record(s)`);
+    let artifactsRemoved = 0;
+    let artifactsKept = 0;
+    for (const receipt of Object.values(res.v4.repos)) {
+      artifactsRemoved += receipt.removed.length;
+      artifactsKept += receipt.kept;
+    }
+    console.log(
+      `repo-index: gc tombstoned ${res.removed.length} orphan authorit${res.removed.length === 1 ? "y" : "ies"}, removed ${artifactsRemoved} artifact(s); kept ${res.kept} authorit${res.kept === 1 ? "y" : "ies"}, ${artifactsKept} artifact(s)`
+    );
   } catch (e) {
     return await failGraceful(e.message);
   }
@@ -39563,6 +40601,10 @@ repoIndex.command("sync-estate").description("Hub indexer: publish a pushed comm
     const cfg = await loadConfig();
     const gh = process.env.GH_TOKEN || process.env.GITHUB_TOKEN || "";
     if (!gh) await failGraceful("sync-estate needs GH_TOKEN or GITHUB_TOKEN with contents:read on target repos");
+    if (!o.json) {
+      console.log(`repo-index: pipeline provenance ${CURRENT_REPO_INDEX_PROVENANCE_TOKEN} \u2014 delta is the normal path${o.plan ? " (plan only: nothing was cloned, embedded or published)" : ""}`);
+    }
+    const streamedWarnings = /* @__PURE__ */ new Set();
     const res = await syncEstateRepoIndex({
       deps: registryClientDeps(cfg),
       repo: o.repo,
@@ -39570,26 +40612,30 @@ repoIndex.command("sync-estate").description("Hub indexer: publish a pushed comm
       fullRebuild: o.fullRebuild,
       skipRepos: o.skipRepo,
       plan: Boolean(o.plan),
-      githubToken: gh
+      githubToken: gh,
+      onClassify: o.json ? void 0 : ({ row, warning }) => {
+        const at = row.targetCommit ? ` target=${row.targetCommit.slice(0, 12)}` : "";
+        const active = row.activeCommit ? ` active=${row.activeCommit.slice(0, 12)}` : "";
+        console.log(`repo-index: ${row.repo} ${row.reason} \u2192 ${row.action}${active}${at}`);
+        if (warning) {
+          streamedWarnings.add(warning);
+          console.error(`repo-index: WARN ${warning}`);
+        }
+      }
     });
     if (o.json) {
       consoleIo.log(JSON.stringify(res, null, 2));
       if (!res.ok) process.exitCode = 1;
       return;
     }
-    console.log(`repo-index: pipeline provenance ${res.provenanceToken} \u2014 delta is the normal path${o.plan ? " (plan only: nothing was cloned, embedded or published)" : ""}`);
-    for (const row of res.drift) {
-      if (row.reason === "healthy") continue;
-      const at = row.targetCommit ? ` target=${row.targetCommit.slice(0, 12)}` : "";
-      const active = row.activeCommit ? ` active=${row.activeCommit.slice(0, 12)}` : "";
-      console.log(`repo-index: ${row.repo} ${row.reason} \u2192 ${row.action}${active}${at}`);
-    }
     for (const p of res.published) {
       const gap = p.embGap ?? Math.max(0, p.fileCount - (p.embCount ?? 0));
       console.log(`repo-index: published v4 ${p.repo} \u2014 ${p.fileCount} chunks emb=${p.embCount ?? 0}/${p.fileCount} gap=${gap} graph=${p.graphEdges ?? "unavailable"}`);
       if (p.metrics) console.log(`repo-index: ${formatV4BuildMetrics(p.repo, p.metrics)}`);
     }
-    for (const warning of res.skipped) console.error(`repo-index: WARN ${warning}`);
+    for (const warning of res.skipped) {
+      if (!streamedWarnings.has(warning)) console.error(`repo-index: WARN ${warning}`);
+    }
     if (res.needsFullRebuild.length) {
       console.error(`repo-index: ${res.needsFullRebuild.length} repo(s) need an explicit tokened migration: ${res.needsFullRebuild.join(", ")}`);
     }
@@ -39668,7 +40714,7 @@ spawnCmd.command("policy").description("enforce the windowsHide contract across
   }
 });
 var tests = program2.command("tests").description("a repo's test-policy.json \u2014 the opt-in test contract and its enforcement");
-tests.command("policy").description("enforce this repo's test-policy.json against the diff: a mandatory-zone change must carry a test, an unrequested new test file is refused, a `protected` test file may not be deleted or renamed away, and a `protected` entry naming a missing file is refused. Override any of them with a `Test-Policy-Override: <reason>` commit trailer (#3605)").option("--json", "machine-readable result: { ok, base, changedCount, findings[] }").option("--base <ref>", "comparison base (default: TEST_POLICY_BASE, then origin/development, then origin/main)").action(async (o) => {
+tests.command("policy").description("enforce this repo's test-policy.json against the diff: a mandatory-zone change must carry a test, an unrequested new test file is refused, a `protected` test file may not be deleted or renamed away, and a `protected` entry naming a missing file is refused. Override any of them with a `Test-Policy-Override: <reason>` commit trailer (#3605)").option("--json", "machine-readable result: { ok, base, changedCount, mandatoryCount, matchedMandatoryCount, matchedMandatoryGlobs, testCommandsAllowed, commandClasses, findings[] }").option("--base <ref>", "comparison base (default: TEST_POLICY_BASE, then origin/development, then origin/main)").action(async (o) => {
   try {
     const root = await repoRoot();
     const result = runTestPolicy(root, { base: o.base });
@@ -39684,8 +40730,9 @@ tests.command("policy").description("enforce this repo's test-policy.json agains
       return;
     }
     if (result.ok) {
+      const commandVerdict = result.testCommandsAllowed ? "test commands: allowed" : `test commands: refused [${result.testCommandReasonId}]`;
       console.log(
-        `tests policy: OK (${result.changedCount} changed file(s); ${result.mandatoryCount} mandatory glob(s), ${result.protectedCount} protected file(s)).`
+        `tests policy: OK (${result.changedCount} changed file(s); ${result.matchedMandatoryCount} of ${result.mandatoryCount} mandatory glob(s) matched, ${result.protectedCount} protected file(s); ${commandVerdict}).`
       );
       return;
     }
@@ -39695,6 +40742,20 @@ tests.command("policy").description("enforce this repo's test-policy.json agains
     await failGraceful(e.message);
   }
 });
+var distCmd = program2.command("dist").description("this repo's committed dist/BOM drift receipt \u2014 whether cli/dist, updater/dist and distribution-bom.json still match a fresh build of source");
+distCmd.command("status").description("rebuild every committed dist artifact to a temp dir and report committed vs rebuilt-expected sha256 plus the BOM's recorded dist identities \u2014 a visible, non-blocking receipt. Development checkouts may lag source until the release fold; drift NEVER fails the run, and nothing is refreshed for you (#5576)").option("--json", "machine-readable receipt: { ok, staleCount, artifacts[], bom, summary } (full hashes; drift still exits 0)").action(async (o) => {
+  try {
+    const root = await repoRoot();
+    const receipt = runDistStatus(root);
+    if (o.json) {
+      consoleIo.log(JSON.stringify({ ok: true, staleCount: receipt.staleCount, artifacts: receipt.artifacts, bom: receipt.bom, summary: receipt.summary }, null, 2));
+      return;
+    }
+    for (const line of renderDistDriftReceipt(receipt)) console.log(line);
+  } catch (e) {
+    await failGraceful(`dist status: ${e.message}`);
+  }
+});
 async function reportWrite(label, res) {
   if (res.ok) {
     console.log(JSON.stringify(res.body));
@@ -39967,7 +41028,7 @@ project.command("set [owner/repo]").description("upsert project META (idempotent
   if (dupe) return fail(`org project set: KEY "${dupe}" was passed to both --var and --set; --set is an alias of --var, so pass each KEY once`);
   if (o.secretsFile) {
     try {
-      vars.push(`secrets=${(0, import_node_fs43.readFileSync)(o.secretsFile, "utf8")}`);
+      vars.push(`secrets=${(0, import_node_fs46.readFileSync)(o.secretsFile, "utf8")}`);
     } catch (e) {
       return fail(`org project set: cannot read --secrets-file ${o.secretsFile}: ${e.message}`);
     }
@@ -40317,7 +41378,7 @@ function resolveCreateSurface(opts) {
 function surfaceWaived() {
   return rawFlag("--no-surface");
 }
-var issue = program2.command("issue").description("issues \u2014 create and view with structured JSON (view; show is an alias for board-verb callers)");
+var issue = program2.command("issue").description("issues \u2014 create and view with structured JSON (view; show is an alias for board-verb callers). Claims are board mutations: use `oracle board claim`, never `oracle issue claim`");
 withExamples(mutating(
   issue.command("create").description("create an issue (type \u2014 label) and print {number,url,label} JSON").addOption(new Option("--type <type>", "bug | feature | task (sets the matching label; required unless --batch)").choices([...ISSUE_TYPES])).option("--title <title>", "issue title").option("--title-file <path|->", "read the issue title from a UTF-8 file, or from stdin with -").option("--body <body>", "issue body (markdown)").option("--body-file <path|->", "read issue body from a UTF-8 file. `-` (stdin) needs a heredoc, which the agent inline-body guard denies (#1473/#2125) \u2014 prefer a real path; a title with backticks needs --title-file for the same reason (#3381)").option("--priority <priority>", "urgent | high | medium | low (defaults to medium; sets the board Priority field only \u2014 never a priority:* label, #416)").option("--repo <owner/repo>", "target repo (defaults to the current repo)").option("--label <label...>", "extra label(s) to attach (repeatable; auto-created if missing)").option("--surface <surface>", "issue surface, with or without the surface: prefix (#3789). Required when the target repo runs the one-surface-label board rule; any value satisfies it, so this is not a closed enum").option("--no-surface", "file without a surface label on a repo that requires one \u2014 for a genuinely exempt filing (e.g. a coop proof issue that spans every surface)").option("--parent <ref>", "file as a native sub-issue of this parent (#123, owner/repo#123, or URL)").option("--no-related", "skip the auto related-issues comment"),
   // --dry-run/--validate-only plan: resolve the same title source and validate the same type, priority,
@@ -40621,7 +41682,7 @@ ${list}`);
   }
   console.log(JSON.stringify({ number: parsed.number, repo, item: result.item.text, checked, changed: true }));
 });
-program2.command("report").description("file a friction report on the Hub board (Hub session auth, dedups open reports) and print {number,url} JSON").option("--title <title>", "one-line friction summary").option("--title-file <path|->", "read the friction summary from a UTF-8 file, or from stdin with -").option("--body <body>", "report body (markdown)").option("--body-file <path|->", "read report body from a UTF-8 file, or from stdin with -").addOption(new Option("--type <type>", "bug | feature | task (sets the matching label)").default("task").choices([...ISSUE_TYPES])).option("--priority <priority>", "urgent | high | medium | low (defaults to medium; sets the board Priority field only, #416)").option("--repo <owner/repo>", 'attribute the report to a different source repo than the current checkout for the "Filed via..." footer (rare \u2014 usually auto-detected; every report always lands on the org Hub, never an alternate target, #263)').option("--force", "file a new issue even when an open report looks like a duplicate").option("--json", "machine-readable output (already the default \u2014 report always prints JSON; #682)").action(async (o) => {
+program2.command("report").description("file a friction report on the Hub board (Hub session auth, dedups open reports) and print {number,url} JSON \u2014 learning-tagged; file and forget (cloud agents own the fix; do not claim/poll it)").option("--title <title>", "one-line friction summary").option("--title-file <path|->", "read the friction summary from a UTF-8 file, or from stdin with -").option("--body <body>", "report body (markdown)").option("--body-file <path|->", "read report body from a UTF-8 file, or from stdin with -").addOption(new Option("--type <type>", "bug | feature | task (sets the matching label)").default("task").choices([...ISSUE_TYPES])).option("--priority <priority>", "urgent | high | medium | low (defaults to medium; sets the board Priority field only, #416)").option("--repo <owner/repo>", 'attribute the report to a different source repo than the current checkout for the "Filed via..." footer (rare \u2014 usually auto-detected; every report always lands on the org Hub, never an alternate target, #263)').option("--force", "file a new issue even when an open report looks like a duplicate").option("--json", "machine-readable output (already the default \u2014 report always prints JSON; #682)").action(async (o) => {
   let body;
   let priority;
   let title;
@@ -40737,6 +41798,7 @@ program2.command("skill-lesson").description("file a skill-lesson on the Hub boa
   }
   const created = requireGhCreateOk(await ghCreate(args), "skill-lesson");
   const { projectItemId, onBoard } = await attachToProject(created.number, targetRepo3, priority);
+  console.log(JSON.stringify({ ...created, projectItemId, onBoard }));
 });
 var pr = program2.command("pr").description("pull requests \u2014 reliable create with structured output");
 withExamples(pr.command("create").description("create a PR and print {number,url} JSON").option("--title <title>", "PR title").option("--title-file <path|->", "read the PR title from a UTF-8 file, or from stdin with -").option("--body <body>", "PR body (markdown)").option("--body-file <path|->", "read PR body from a UTF-8 file, or from stdin with -").option("--base <branch>", "base branch (defaults to the repo default)").option("--head <branch>", "head branch (defaults to the current branch)").option("--repo <owner/repo>", "target repo (defaults to the current repo)").option("--draft", "open the PR in draft state (#2667)").option("--json", "machine-readable output (default; accepted for parity)").action(async (o) => {
@@ -40791,11 +41853,11 @@ pr.command("view <number>").description("read a PR as structured JSON (merged st
   }
 });
 async function listCiWorkflowPaths(cwd = process.cwd()) {
-  const wfDir = (0, import_node_path40.join)(cwd, ".github", "workflows");
-  if (!(0, import_node_fs43.existsSync)(wfDir)) return [];
-  return (0, import_node_fs43.readdirSync)(wfDir).filter((name) => /\.(ya?ml)$/i.test(name)).filter((name) => {
+  const wfDir = (0, import_node_path42.join)(cwd, ".github", "workflows");
+  if (!(0, import_node_fs46.existsSync)(wfDir)) return [];
+  return (0, import_node_fs46.readdirSync)(wfDir).filter((name) => /\.(ya?ml)$/i.test(name)).filter((name) => {
     try {
-      return workflowReportsPrChecks((0, import_node_fs43.readFileSync)((0, import_node_path40.join)(wfDir, name), "utf8"));
+      return workflowReportsPrChecks((0, import_node_fs46.readFileSync)((0, import_node_path42.join)(wfDir, name), "utf8"));
     } catch {
       return true;
     }
@@ -40847,16 +41909,16 @@ function ciAuditDeps() {
     // gate re-seed step is skipped gracefully rather than failing mid-run.
     readSeedFile: (path2) => {
       if (!root) return null;
-      const fullPath = (0, import_node_path40.join)(root, path2);
-      return (0, import_node_fs43.existsSync)(fullPath) ? (0, import_node_fs43.readFileSync)(fullPath, "utf8") : null;
+      const fullPath = (0, import_node_path42.join)(root, path2);
+      return (0, import_node_fs46.existsSync)(fullPath) ? (0, import_node_fs46.readFileSync)(fullPath, "utf8") : null;
     }
   };
 }
 function hubRoot() {
-  const fromPkg = (0, import_node_path40.join)(__dirname, "..", "..");
+  const fromPkg = (0, import_node_path42.join)(__dirname, "..", "..");
   const marker = "skills/bootstrap/seeds/manifest.json";
-  if ((0, import_node_fs43.existsSync)((0, import_node_path40.join)(fromPkg, marker))) return fromPkg;
-  if ((0, import_node_fs43.existsSync)((0, import_node_path40.join)(process.cwd(), marker))) return process.cwd();
+  if ((0, import_node_fs46.existsSync)((0, import_node_path42.join)(fromPkg, marker))) return fromPkg;
+  if ((0, import_node_fs46.existsSync)((0, import_node_path42.join)(process.cwd(), marker))) return process.cwd();
   return null;
 }
 async function waitLoopCorePool(label) {
@@ -40905,7 +41967,12 @@ pr.command("checks-wait <number>").description(`bounded wait for ALL checks on t
     timeoutMs = Math.round(minutes * 6e4);
   }
   const repo = await requireRepo(o.repo);
-  const snapshotRead = await readRestPrSnapshotWithRetry(number, repo);
+  const budgetMs = timeoutMs ?? PR_CHECKS_TIMEOUT_MS;
+  const waitStarted = Date.now();
+  const snapshotRead = await readRestPrSnapshotWithRetry(number, repo, void 0, {
+    retryTransientUntilMs: waitStarted + budgetMs,
+    onTransientRetry: (error, attempt) => console.warn(`pr checks-wait: transient GitHub read (${error}) \u2014 retrying PR snapshot (attempt ${attempt}) within the wait budget`)
+  });
   if (snapshotRead.state === "failed") {
     return fail(`pr checks-wait: cannot resolve PR #${number}'s base branch \u2014 ${snapshotRead.error}. Refusing to wait against an assumed base; retry when the API answers.`);
   }
@@ -40926,9 +41993,9 @@ pr.command("checks-wait <number>").description(`bounded wait for ALL checks on t
     // #5400: after grace, name "GitHub delivered zero runs" instead of burning the full budget as pending.
     pollHeadWorkflowRunCount: () => waitLoopHeadWorkflowRunCount("pr checks-wait", number, repo),
     baseBranch,
-    sleep: (ms) => new Promise((resolve5) => setTimeout(resolve5, ms)),
+    sleep: (ms) => new Promise((resolve6) => setTimeout(resolve6, ms)),
     log: (message) => console.warn(message),
-    timeoutMs,
+    timeoutMs: Math.max(1, budgetMs - (Date.now() - waitStarted)),
     // Liveness on stderr, one line per poll. A silent bounded wait is indistinguishable from a hang, and
     // an agent harness kills it on its own (shorter) deadline before the verdict ever prints (#2940).
     progress: ({ state, elapsedMs, remainingMs }) => console.warn(`pr checks-wait: ${state} \u2014 ${Math.round(elapsedMs / 1e3)}s elapsed, ${Math.round(remainingMs / 6e4)}m left`)
@@ -41022,7 +42089,7 @@ pr.command("land <number>").description("agent merge path (#1440): train probe \
         // #5400: same zero-runs delivery probe as checks-wait — do not burn the land budget on silence.
         pollHeadWorkflowRunCount: () => waitLoopHeadWorkflowRunCount("pr land", prNumber, repo),
         baseBranch: "development",
-        sleep: (ms) => new Promise((resolve5) => setTimeout(resolve5, ms)),
+        sleep: (ms) => new Promise((resolve6) => setTimeout(resolve6, ms)),
         log: (message) => console.warn(message),
         // `pr land` inherits the same (raised) checks budget, so it needs the same liveness — otherwise the
         // 30m wait is SILENT and reads exactly like the hang #2940 was filed about, only three times longer.
@@ -41065,7 +42132,7 @@ pr.command("land <number>").description("agent merge path (#1440): train probe \
         } else {
           lastFailure = void 0;
         }
-        await new Promise((resolve5) => setTimeout(resolve5, PR_LAND_POLL_MS));
+        await new Promise((resolve6) => setTimeout(resolve6, PR_LAND_POLL_MS));
       }
       if (lastFailure) {
         throw new Error(
@@ -41149,7 +42216,12 @@ jsonParity(pr.command("merge <number>").description("merge a PR (squash by defau
   const ciPolicy = await resolveMergeCiPolicyForCheckout(o.repo, ciHeadRef);
   if (o.wait) {
     const repo = await requireRepo(o.repo);
-    const snapshotRead = await readRestPrSnapshotWithRetry(number, repo);
+    const budgetMs = PR_CHECKS_TIMEOUT_MS;
+    const waitStarted = Date.now();
+    const snapshotRead = await readRestPrSnapshotWithRetry(number, repo, void 0, {
+      retryTransientUntilMs: waitStarted + budgetMs,
+      onTransientRetry: (error, attempt) => console.warn(`pr merge: transient GitHub read (${error}) \u2014 retrying PR snapshot (attempt ${attempt}) within the --wait budget`)
+    });
     if (snapshotRead.state === "failed") {
       console.error(`pr merge: cannot resolve PR #${number}'s base branch \u2014 ${snapshotRead.error}. Refusing to wait against an assumed base; retry when the API answers.`);
       process.exitCode = 1;
@@ -41165,8 +42237,9 @@ jsonParity(pr.command("merge <number>").description("merge a PR (squash by defau
       diagnoseFailure: () => waitLoopDiagnosis("pr merge --wait", number, repo),
       pollHeadWorkflowRunCount: () => waitLoopHeadWorkflowRunCount("pr merge --wait", number, repo),
       baseBranch,
-      sleep: (ms) => new Promise((resolve5) => setTimeout(resolve5, ms)),
+      sleep: (ms) => new Promise((resolve6) => setTimeout(resolve6, ms)),
       log: (message) => console.warn(message),
+      timeoutMs: Math.max(1, budgetMs - (Date.now() - waitStarted)),
       progress: ({ state, elapsedMs, remainingMs }) => console.warn(`pr merge: --wait checks \u2014 ${state}, ${Math.round(elapsedMs / 1e3)}s elapsed, ${Math.round(remainingMs / 6e4)}m left`)
     });
     if (wait.status !== "success" && wait.status !== "skipped") {
@@ -41200,7 +42273,7 @@ jsonParity(pr.command("merge <number>").description("merge a PR (squash by defau
         }
         if (!repoForPostCleanup) throw e;
         console.warn(`pr merge: gh GraphQL rate-limited \u2014 merging PR #${number} via REST PUT instead (#4588).`);
-        const commitMessage = bodyFile ? (0, import_node_fs43.readFileSync)(bodyFile, "utf8") : void 0;
+        const commitMessage = bodyFile ? (0, import_node_fs46.readFileSync)(bodyFile, "utf8") : void 0;
         await defaultGitHubClient().rest("PUT", `repos/${repoForPostCleanup}/pulls/${number}/merge`, {
           body: { merge_method: method.slice(2), ...commitMessage ? { commit_message: commitMessage } : {} },
           timeoutMs: GH_MUTATION_TIMEOUT_MS
@@ -41896,12 +42969,12 @@ access.command("audit").description("audit collaborator roles + train-branch pus
     targets = resolution.targets;
   }
   const derivedMatrix = registryProjects ? accessMatrixFromProjects(registryProjects) : {};
-  const fileMatrix = (0, import_node_fs43.existsSync)("access-matrix.json") ? loadAccessMatrix((0, import_node_fs43.readFileSync)("access-matrix.json", "utf8")) : {};
+  const fileMatrix = (0, import_node_fs46.existsSync)("access-matrix.json") ? loadAccessMatrix((0, import_node_fs46.readFileSync)("access-matrix.json", "utf8")) : {};
   const matrix = mergeAccessMatrix(fileMatrix, derivedMatrix);
   const derivedContracts = registryProjects ? dataAccessContractsFromProjects(registryProjects) : { consumers: {} };
-  const fileContracts = (0, import_node_fs43.existsSync)("data-access-contracts.json") ? loadDataAccessContracts((0, import_node_fs43.readFileSync)("data-access-contracts.json", "utf8")) : { consumers: {} };
+  const fileContracts = (0, import_node_fs46.existsSync)("data-access-contracts.json") ? loadDataAccessContracts((0, import_node_fs46.readFileSync)("data-access-contracts.json", "utf8")) : { consumers: {} };
   const dataAccess = mergeDataAccessContracts(fileContracts, derivedContracts);
-  const sanctioned = (0, import_node_fs43.existsSync)("access-matrix.json") ? loadSanctionedAdmins((0, import_node_fs43.readFileSync)("access-matrix.json", "utf8")) : {};
+  const sanctioned = (0, import_node_fs46.existsSync)("access-matrix.json") ? loadSanctionedAdmins((0, import_node_fs46.readFileSync)("access-matrix.json", "utf8")) : {};
   const report = await auditOrgAccess(targets, deps, matrix, dataAccess, sanctioned);
   console.log(o.json ? JSON.stringify(report, null, 2) : renderAccessReport(report));
   if (!report.ok) process.exitCode = 1;
@@ -41933,16 +43006,16 @@ function directoryBytes(path2) {
   let total = 0;
   let entries;
   try {
-    entries = (0, import_node_fs43.readdirSync)(path2, { withFileTypes: true });
+    entries = (0, import_node_fs46.readdirSync)(path2, { withFileTypes: true });
   } catch {
     return 0;
   }
   for (const entry of entries) {
-    const child2 = (0, import_node_path40.join)(path2, entry.name);
+    const child2 = (0, import_node_path42.join)(path2, entry.name);
     if (entry.isDirectory()) total += directoryBytes(child2);
     else {
       try {
-        total += (0, import_node_fs43.statSync)(child2).size;
+        total += (0, import_node_fs46.statSync)(child2).size;
       } catch {
       }
     }
@@ -41950,25 +43023,25 @@ function directoryBytes(path2) {
   return total;
 }
 function listDirEntries(dir) {
-  return (0, import_node_fs43.readdirSync)(dir, { withFileTypes: true }).map((d) => ({ name: d.name, isDirectory: d.isDirectory() }));
+  return (0, import_node_fs46.readdirSync)(dir, { withFileTypes: true }).map((d) => ({ name: d.name, isDirectory: d.isDirectory() }));
 }
 function readInstalledPluginRefs(configRoot) {
   const p = installedPluginsPathForConfig(configRoot);
-  if (!(0, import_node_fs43.existsSync)(p)) return [];
+  if (!(0, import_node_fs46.existsSync)(p)) return [];
   try {
-    return installedPluginPaths((0, import_node_fs43.readFileSync)(p, "utf8"));
+    return installedPluginPaths((0, import_node_fs46.readFileSync)(p, "utf8"));
   } catch {
     return null;
   }
 }
 function pluginCacheFsDeps(configRoot, dirBytes) {
   return {
-    exists: (p) => (0, import_node_fs43.existsSync)(p),
-    listVersionDirs: (root) => (0, import_node_fs43.readdirSync)(root, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name),
+    exists: (p) => (0, import_node_fs46.existsSync)(p),
+    listVersionDirs: (root) => (0, import_node_fs46.readdirSync)(root, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name),
     dirBytes,
-    listStagingDirs: (root) => (0, import_node_fs43.readdirSync)(root, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => {
+    listStagingDirs: (root) => (0, import_node_fs46.readdirSync)(root, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => {
       try {
-        return { name: d.name, mtimeMs: newestMtimeMs((0, import_node_path40.join)(root, d.name), listDirEntries, (p) => (0, import_node_fs43.statSync)(p).mtimeMs) };
+        return { name: d.name, mtimeMs: newestMtimeMs((0, import_node_path42.join)(root, d.name), listDirEntries, (p) => (0, import_node_fs46.statSync)(p).mtimeMs) };
       } catch {
         return { name: d.name, mtimeMs: Date.now() };
       }
@@ -41982,10 +43055,10 @@ function stagingApplyFsGuard(configRoot) {
   return {
     referencedPaths: () => readInstalledPluginRefs(configRoot),
     mtimeMs: (name) => {
-      const p = (0, import_node_path40.join)(stagingRoot, name);
-      if (!(0, import_node_fs43.existsSync)(p)) return null;
+      const p = (0, import_node_path42.join)(stagingRoot, name);
+      if (!(0, import_node_fs46.existsSync)(p)) return null;
       try {
-        return newestMtimeMs(p, listDirEntries, (q) => (0, import_node_fs43.statSync)(q).mtimeMs);
+        return newestMtimeMs(p, listDirEntries, (q) => (0, import_node_fs46.statSync)(q).mtimeMs);
       } catch {
         return null;
       }
@@ -42005,13 +43078,13 @@ program2.command("plugin-prune").description(`prune stale cached MMI plugin vers
     return;
   }
   const plan = buildPluginCachePlan(
-    (0, import_node_os19.homedir)(),
+    (0, import_node_os21.homedir)(),
     running,
     pluginCacheFsDeps(configRoot, directoryBytes),
     { withBytes: true, configRoot, includeStaging: surface !== "codex" }
   );
   const anythingToDelete = plan.prune.length > 0 || plan.staging.length > 0;
-  const result = o.apply && anythingToDelete ? applyPluginCachePlan(plan, (p) => (0, import_node_fs43.rmSync)(p, { recursive: true, force: true }), stagingApplyFsGuard(configRoot)) : void 0;
+  const result = o.apply && anythingToDelete ? applyPluginCachePlan(plan, (p) => (0, import_node_fs46.rmSync)(p, { recursive: true, force: true }), stagingApplyFsGuard(configRoot)) : void 0;
   const warnings = plan.prune.length > 0 ? [CONCURRENT_SESSION_WARNING] : [];
   if (o.json) console.log(JSON.stringify({ ...plan, warnings, applied: result ?? null }));
   else console.log(renderPluginCachePlan(plan, result));