@mutmutco/cli 4.1.20 → 4.2.1

package/dist/main.cjs

@@ -3415,8 +3415,8 @@ var program = new Command();
 
 // src/index.ts
 var import_promises8 = require("node:fs/promises");
-var import_node_fs42 = require("node:fs");
-var import_node_child_process17 = require("node:child_process");
+var import_node_fs43 = require("node:fs");
+var import_node_child_process19 = require("node:child_process");
 
 // src/cli-shared.ts
 var import_node_child_process3 = require("node:child_process");
@@ -5538,7 +5538,7 @@ function commandLadderHint() {
 }
 
 // src/index.ts
-var import_node_path38 = require("node:path");
+var import_node_path40 = require("node:path");
 
 // src/merge-ci-policy.ts
 function resolveMergeCiPolicy(input) {
@@ -7287,6 +7287,7 @@ function parseOwnerRepo(repo) {
   if (owner.includes("\\") || name.includes("\\")) throw new Error("repo must be owner/repo");
   return { owner, name, slug: name.toLowerCase(), fullName: `${owner}/${name}` };
 }
+var MANAGED_DELETE_BRANCH_ON_MERGE = false;
 var DEFAULT_GATE_CMD = "npm run check";
 var DEFAULT_GATE_MAX_SECONDS = "300";
 var DEFAULT_GATE_PY_VERSION = "3.11";
@@ -11761,10 +11762,10 @@ var rollout_plan_default = {
     note: "The v4.0.0 stamp happens at cut time (D6e #4463); until then the candidate is the origin/development head artifacts (built cli/dist + npm pack), identity proven by dist content hash (D6a)."
   },
   baseline: {
-    version: "4.1.20",
-    tag: "v4.1.20",
-    commit: "12c94bf54a89",
-    npm: "@mutmutco/cli@4.1.20"
+    version: "4.2.1",
+    tag: "v4.2.1",
+    commit: "66e67b6905a1",
+    npm: "@mutmutco/cli@4.2.1"
   },
   exitCriterion: "fleet-n-of-n",
   hubOnlyShortcut: "forbidden",
@@ -11781,14 +11782,14 @@ var rollout_plan_default = {
           repo: "mutmutco/mmi-hub",
           role: "canary",
           schedule: "train",
-          v3Target: "v4.1.20"
+          v3Target: "v4.2.1"
         }
       ],
       rollbackTrigger: "Any red inside the post-contract soak window: `devops train gate` FAIL attributable to the v4 doors, Hub endpoint health probe failure, a pre-v4 client admitted instead of receiving actionable HTTP 426, or npm consumer install/doctor failure on the v4-only dist.",
       rollback: {
         independent: true,
-        mechanism: "npm dist-tag latest -> 4.1.20 and redeploy the Hub Lambda from tag v4.1.20 (12c94bf54a89); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
-        v3Target: "v4.1.20 (@mutmutco/cli@4.1.20, tag commit 12c94bf54a89 \u2014 last known-good release carrying the repo-index v4-only contract)"
+        mechanism: "npm dist-tag latest -> 4.2.1 and redeploy the Hub Lambda from tag v4.2.1 (66e67b6905a1); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
+        v3Target: "v4.2.1 (@mutmutco/cli@4.2.1, tag commit 66e67b6905a1 \u2014 last known-good release carrying the repo-index v4-only contract)"
       }
     },
     {
@@ -14738,10 +14739,16 @@ async function correlateWorkflowRun(deps, args) {
 async function watchTenantRun(deps, runId, repo = HUB_REPO3) {
   if (runId == null) return "pending";
   let watchSaidSuccess = true;
+  const startedAt = Date.now();
+  deps.warn?.(`watching workflow run ${runId} (${repo})`);
+  const heartbeat = deps.warn ? setInterval(() => deps.warn?.(`workflow run ${runId} (${repo}) still running \u2014 ${Math.floor((Date.now() - startedAt) / 6e4)}m elapsed`), 6e4) : void 0;
+  heartbeat?.unref();
   try {
     await deps.run("gh", ["run", "watch", String(runId), "--repo", repo, "--exit-status"]);
   } catch {
     watchSaidSuccess = false;
+  } finally {
+    if (heartbeat) clearInterval(heartbeat);
   }
   const sleep2 = resolveSleep(deps);
   let confirmError;
@@ -15824,7 +15831,7 @@ function assertNpmMajorPreflight(opts) {
   if (localMajor === void 0 || expectedMajor === void 0) return;
   if (localMajor === expectedMajor) return;
   throw new Error(
-    `${opts.repo}: Step 0a npm-major preflight failed \u2014 local npm ${localNpm} (major ${localMajor}) \u2260 CI npm ${expectedNpm} (major ${expectedMajor}). Align local npm before --apply: \`npm install -g npm@${expectedNpm}\`. This is an npm-major mismatch (#5666/#5616/#4578), not a lockfile or publish-surface problem. When gate.yml has no bundled npm pin, read the publish workflow npm pin; otherwise compare \`npm -v\` with the green gate log's toolchain-preflight line (#3446).`
+    `${opts.repo}: Step 0a npm-major preflight failed \u2014 local npm ${localNpm} (major ${localMajor}) \u2260 CI npm ${expectedNpm} (major ${expectedMajor}). Supported repair (preserves Node): \`npm install -g npm@${expectedNpm}\`; then verify with \`node -v && npm -v\` and rerun the same release command. This is an npm-major mismatch (#5666/#5616/#4578), not a lockfile or publish-surface problem. When gate.yml has no bundled npm pin, read the publish workflow npm pin; otherwise compare \`npm -v\` with the green gate log's toolchain-preflight line (#3446).`
   );
 }
 async function assertNpmMajorPreflightFromWorkflows(deps, repo) {
@@ -16108,15 +16115,9 @@ async function runRcandResume(deps, options = {}) {
     note: `reused immutable ${tag}; pushed its exact SHA to rc and dispatched the rc deploy`
   };
 }
-async function runReleaseResume(deps, options = {}) {
+async function runReleaseResumePipeline(deps, options, prepared) {
   const watch = options.watch ?? false;
-  const ctx = await buildTrainApplyContext(deps);
-  await requireCleanTree(deps);
-  await runGitRemoteRead(deps, ["fetch", "origin", "--tags"]);
-  const meta = requireProjectMetaForTrain(await loadProjectMeta(deps, ctx), ctx.repo);
-  const branchHints = await loadReleaseTrackBranchHints(deps);
-  const directTrack = isHubControlRepo(ctx.repo) || resolveReleaseTrack(meta, branchHints) === "direct";
-  const deployModel = await preflight(deps, ctx, "main", meta);
+  const { ctx, meta, branchHints, directTrack, deployModel } = prepared;
   const tags = clean2(await deps.run("git", ["tag", "--list", "v[0-9]*.[0-9]*.[0-9]*", "--sort=-v:refname"])).split("\n").map((t) => t.trim()).filter((t) => /^v\d+\.\d+\.\d+$/.test(t));
   const tag = tags[0];
   if (!tag) throw new Error("release --resume: no final v* release tag found \u2014 there is no release to resume");
@@ -16224,6 +16225,36 @@ async function runReleaseResume(deps, options = {}) {
     note: followUp === "failed" ? `resumed ${tag} (version preserved, not re-cut) \u2014 but a watched deploy/publish run FAILED; the Release stands, re-run the failed job (do NOT re-tag)` : followUp === "pending" ? `resumed ${tag} (version preserved, not re-cut) \u2014 a deploy/publish or alignment follow-up is unresolved; watch it to completion` : `resumed and completed ${tag} \u2014 the original version was preserved, not re-cut`
   };
 }
+async function withCheckoutRestoredAfterReleaseResume(deps, startBranch, operation) {
+  let result;
+  try {
+    result = await operation();
+  } catch (error) {
+    let checkoutNote;
+    try {
+      checkoutNote = (await restoreCheckoutAfterRelease(deps, startBranch)).note;
+    } catch (restoreError) {
+      checkoutNote = `checkout restoration failed while returning to ${startBranch}: ${restoreError instanceof Error ? restoreError.message : String(restoreError)}`;
+    }
+    throw new Error(`${error instanceof Error ? error.message : String(error)}; ${checkoutNote}`);
+  }
+  return withCheckoutRestoredAfterRelease(deps, result, startBranch);
+}
+async function runReleaseResume(deps, options = {}) {
+  const ctx = await buildTrainApplyContext(deps);
+  await requireCleanTree(deps);
+  await runGitRemoteRead(deps, ["fetch", "origin", "--tags"]);
+  const meta = requireProjectMetaForTrain(await loadProjectMeta(deps, ctx), ctx.repo);
+  const branchHints = await loadReleaseTrackBranchHints(deps);
+  const directTrack = isHubControlRepo(ctx.repo) || resolveReleaseTrack(meta, branchHints) === "direct";
+  const deployModel = await preflight(deps, ctx, "main", meta);
+  const startBranch = directTrack ? "development" : "rc";
+  return withCheckoutRestoredAfterReleaseResume(
+    deps,
+    startBranch,
+    () => runReleaseResumePipeline(deps, options, { ctx, meta, branchHints, directTrack, deployModel })
+  );
+}
 async function runReleaseAbort(deps, options = {}) {
   if (!options.approved) {
     throw new Error("release --abort requires --apply after explicit approval; nothing was written");
@@ -16313,8 +16344,9 @@ async function runReleasePublishRetry(deps, runId, options = {}) {
     }
   };
   const run = await readRun();
-  if (run.databaseId !== runId || run.workflowName !== "publish" || run.event !== "release" || run.status !== "completed" || run.conclusion !== "failure") {
-    throw new Error(`run ${runId} is not a completed failed Hub publish release run; nothing was written`);
+  const retryableConclusion = run.conclusion === "failure" || run.conclusion === "cancelled";
+  if (run.databaseId !== runId || run.workflowName !== "publish" || run.event !== "release" || run.status !== "completed" || !retryableConclusion) {
+    throw new Error(`run ${runId} is not a completed failed or cancelled Hub publish release run; nothing was written`);
   }
   const tag = run.headBranch ?? "";
   const tagSha = run.headSha ?? "";
@@ -16325,13 +16357,16 @@ async function runReleasePublishRetry(deps, runId, options = {}) {
     throw new Error(`run ${runId} does not match origin ${tag}; nothing was written`);
   }
   await verifyPublishedRelease(deps, ctx.repo, tag, "main", tagSha);
-  await deps.run("gh", ["run", "rerun", String(runId), "--repo", ctx.repo, "--failed"]);
-  if (options.watch) {
-    await deps.run("gh", ["run", "watch", String(runId), "--repo", ctx.repo, "--exit-status"]);
-    const completed = await readRun();
-    if (completed.status !== "completed" || completed.conclusion !== "success") {
-      throw new Error(`publish run ${runId} did not finish successfully after retry`);
-    }
+  await deps.run("gh", [
+    "run",
+    "rerun",
+    String(runId),
+    "--repo",
+    ctx.repo,
+    ...run.conclusion === "failure" ? ["--failed"] : []
+  ]);
+  if (options.watch && await watchTenantRun(deps, runId, ctx.repo) !== "success") {
+    throw new Error(`publish run ${runId} did not finish successfully after retry`);
   }
   return {
     command: "release-retry-publish",
@@ -16341,7 +16376,7 @@ async function runReleasePublishRetry(deps, runId, options = {}) {
     runId,
     runUrl: run.url ?? `https://github.com/${ctx.repo}/actions/runs/${runId}`,
     status: options.watch ? "success" : "pending",
-    note: options.watch ? `publish run ${runId} retried and passed` : `publish run ${runId} failed jobs queued for retry`
+    note: options.watch ? `publish run ${runId} retried and passed` : `publish run ${runId} queued for retry`
   };
 }
 async function runTrainApplyPipeline(mode, input) {
@@ -17130,7 +17165,7 @@ async function auditRepoCi(repo, deps) {
     ok: info.allow_auto_merge === true,
     label: "allow_auto_merge enabled",
     detail: info.allow_auto_merge === true ? void 0 : "false or unavailable",
-    remediation: `gh api -X PATCH repos/${repo} -f allow_auto_merge=true -f allow_squash_merge=true -f delete_branch_on_merge=true`
+    remediation: `gh api -X PATCH repos/${repo} -f allow_auto_merge=true -f allow_squash_merge=true -F delete_branch_on_merge=${MANAGED_DELETE_BRANCH_ON_MERGE}`
   });
   checks.push({
     ok: info.allow_squash_merge === true,
@@ -17138,9 +17173,9 @@ async function auditRepoCi(repo, deps) {
     detail: info.allow_squash_merge === true ? void 0 : "false or unavailable"
   });
   checks.push({
-    ok: info.delete_branch_on_merge === true,
-    label: "delete_branch_on_merge enabled",
-    detail: info.delete_branch_on_merge === true ? void 0 : "false or unavailable"
+    ok: info.delete_branch_on_merge === MANAGED_DELETE_BRANCH_ON_MERGE,
+    label: "delete_branch_on_merge disabled",
+    detail: info.delete_branch_on_merge === MANAGED_DELETE_BRANCH_ON_MERGE ? void 0 : "merged branches must survive until delayed cleanup proves no open PR uses them as a base (#5789)"
   });
   checks.push({
     ok: info.has_wiki === false,
@@ -17447,11 +17482,11 @@ async function applyCiReconcileMergeSettingsFromReport(repo, deps, report) {
       body: {
         allow_auto_merge: true,
         allow_squash_merge: true,
-        delete_branch_on_merge: true,
+        delete_branch_on_merge: MANAGED_DELETE_BRANCH_ON_MERGE,
         has_wiki: false
       }
     });
-    applied.push("allow_auto_merge, allow_squash_merge, delete_branch_on_merge, has_wiki=false");
+    applied.push("allow_auto_merge, allow_squash_merge, preserve merged remote branches, has_wiki=false");
   } catch (e) {
     errors.push(e.message);
   }
@@ -17682,6 +17717,12 @@ async function finalizeCiReconcile(repo, deps, result, before, pendingReason) {
     return result;
   }
 }
+function ciReconcileExitFailed(input) {
+  if (!input.apply || input.applyResults.length === 0) {
+    return !input.audit.ok || input.applyResults.some((result) => result.errors.length > 0 || result.postApply?.state === "failed");
+  }
+  return input.applyResults.some((result) => result.errors.length > 0 || result.postApply == null || result.postApply.state !== "clean" && result.postApply.state !== "repaired");
+}
 async function authoritativeSafetyHold(authority, deps, repo, baseBranch) {
   if (authority.coversReleaseBranches) {
     const prOnly = authority.contexts.filter((context) => TRAIN_PR_ONLY_CONTEXTS.has(context));
@@ -20892,6 +20933,11 @@ async function readBoard(options, deps = {}) {
     report[scope].claimable = filtered.claimable;
     report.warnings.push(...filtered.warnings);
   }
+  for (const scope of ["primary", "secondary"]) {
+    const demoted = await demoteLiveClaimedClaimables(report[scope], client);
+    report.warnings.push(...demoted.warnings);
+    report.partial = report.partial || demoted.partial;
+  }
   return report;
 }
 function findBoardItem(items, selector, board) {
@@ -20903,11 +20949,11 @@ function findBoardItem(items, selector, board) {
 }
 async function resolveCurrentRepo(options, deps) {
   if (options.repo) return options.repo;
-  const git2 = deps.git ?? defaultGit;
+  const git3 = deps.git ?? defaultGit;
   let gitFailure;
   let originUrl = "";
   try {
-    originUrl = await git2(["remote", "get-url", "origin"]);
+    originUrl = await git3(["remote", "get-url", "origin"]);
   } catch (e) {
     const read = gitReadState(e);
     if (read.state === "failed") gitFailure = read.detail;
@@ -21753,6 +21799,66 @@ function boardItemClaim(item) {
     currentlyClaimed: item.assignees.length > 0 && item.status === "In Progress"
   };
 }
+function classifyClaimableMarker(comments, actor, now = Date.now()) {
+  const marker = comments ? latestClaimMarker(comments) : void 0;
+  if (!marker) return { verdict: "claimable" };
+  const ownership = laneOwnership(marker, actor);
+  if (ownership === "mine") return { verdict: "owned", holder: describeClaimMarker(marker) };
+  const age = now - Date.parse(marker.ts);
+  if (Number.isFinite(age) && age >= 0 && age < CLAIM_MARKER_LIVE_MS) {
+    return { verdict: "taken", holder: describeClaimMarker(marker) };
+  }
+  return { verdict: "claimable" };
+}
+async function demoteLiveClaimedClaimables(scope, client, actor = describeSessionIdentity(), deps = {}) {
+  const warnings = [];
+  let partial = false;
+  const fetchComments = deps.fetchComments ?? (async (item) => {
+    if (item.details) return item.details.comments;
+    const comments = await client.restPaginate(`repos/${item.repository}/issues/${item.number}/comments`);
+    return comments.map((comment) => ({ body: comment.body ?? "" }));
+  });
+  const stillClaimable = [];
+  const movedTaken = [];
+  const movedOwned = [];
+  for (const item of scope.claimable) {
+    if (item.contentType !== "Issue") {
+      stillClaimable.push(item);
+      continue;
+    }
+    let comments;
+    try {
+      comments = await fetchComments(item);
+    } catch {
+      comments = void 0;
+    }
+    if (comments === void 0) {
+      partial = true;
+      warnings.push(`${item.ref} left claimable: claim-marker evidence could not be read`);
+      continue;
+    }
+    const verdict = classifyClaimableMarker(comments, actor, deps.now);
+    if (verdict.verdict === "claimable") {
+      stillClaimable.push(item);
+    } else if (verdict.verdict === "owned") {
+      movedOwned.push(item);
+      warnings.push(`${item.ref} is held by your own lane (${verdict.holder}) \u2014 moved to user-owned`);
+    } else {
+      movedTaken.push(item);
+      warnings.push(`${item.ref} is held by a live claim marker (lane ${verdict.holder}) \u2014 no longer claimable`);
+    }
+  }
+  scope.claimable = stillClaimable;
+  if (movedTaken.length) {
+    scope.taken.push(...movedTaken);
+    scope.taken.sort(compareItems);
+  }
+  if (movedOwned.length) {
+    scope.userOwned.push(...movedOwned);
+    scope.userOwned.sort(compareItems);
+  }
+  return { warnings, partial };
+}
 async function postClaimMarkerComment(client, item, actor = describeSessionIdentity()) {
   try {
     const marker = {
@@ -23374,11 +23480,69 @@ function renderPluginCachePlan(plan, applied) {
   return lines.join("\n");
 }
 
-// src/statusline-invalidate.ts
+// src/train-self-converge.ts
 var import_node_child_process10 = require("node:child_process");
+var SELF_CONVERGE_INSTALL_TIMEOUT_MS = 12e4;
+var SELF_CONVERGE_VERSION_TIMEOUT_MS = 3e4;
+var isWin2 = process.platform === "win32";
+var defaultDeps = {
+  // Pin the exact released version (never `@latest` — a cached packument resolves the tag to the
+  // PREVIOUS version in exactly this post-publish window, #3422). execFileP rejects on nonzero exit.
+  update: async (target) => {
+    const args = ["install", "-g", `@mutmutco/cli@${target}`];
+    if (isWin2) {
+      await execFileP2("cmd.exe", ["/c", "npm", ...args], { timeout: SELF_CONVERGE_INSTALL_TIMEOUT_MS });
+    } else {
+      await execFileP2("npm", args, { timeout: SELF_CONVERGE_INSTALL_TIMEOUT_MS });
+    }
+  },
+  // Read the version the freshly installed `mmi-cli` on PATH actually resolves to. Unparseable or
+  // failed read answers undefined so the flow reports not-taken-effect instead of guessing green.
+  readInstalledVersion: async () => {
+    try {
+      const { stdout } = isWin2 ? await execFileP2("cmd.exe", ["/c", "mmi-cli", "--version"], { timeout: SELF_CONVERGE_VERSION_TIMEOUT_MS }) : await execFileP2("mmi-cli", ["--version"], { timeout: SELF_CONVERGE_VERSION_TIMEOUT_MS });
+      return parseNpmVersion(stdout);
+    } catch {
+      return void 0;
+    }
+  },
+  // Re-exec the SAME command line in the fresh CLI with inherited stdio (spawn, not execFile, so
+  // output streams live) and hand its exit code back — the stale parent exits with it (#5762).
+  reexec: () => new Promise((resolve6) => {
+    const args = process.argv.slice(2);
+    const child2 = isWin2 ? (0, import_node_child_process10.spawn)("cmd.exe", ["/c", "mmi-cli", ...args], { stdio: "inherit", windowsHide: true }) : (0, import_node_child_process10.spawn)("mmi-cli", args, { stdio: "inherit", windowsHide: true });
+    child2.on("exit", (code) => resolve6(code ?? 1));
+    child2.on("error", () => resolve6(1));
+  }),
+  // stderr only — stdout may be carrying --json output.
+  warn: (line) => console.error(line)
+};
+async function selfConvergeTrainCli(input) {
+  const deps = { ...defaultDeps, ...input.deps };
+  try {
+    deps.warn(
+      `train: running mmi-cli ${input.currentVersion} is stale against released ${input.releasedVersion} \u2014 self-converging via npm install -g @mutmutco/cli@${input.releasedVersion} before resuming ${input.commandName}`
+    );
+    await deps.update(input.releasedVersion);
+    const installed = await deps.readInstalledVersion();
+    if (!installed || compareVersions(installed, input.releasedVersion) < 0) {
+      return {
+        kind: "failed",
+        error: `self-converge did not take effect: mmi-cli on PATH still resolves to ${installed ?? "unknown"}, expected >= ${input.releasedVersion}`
+      };
+    }
+    const reexecCode = await deps.reexec();
+    return { kind: "converged", reexecCode };
+  } catch (e) {
+    return { kind: "failed", error: e instanceof Error ? e.message : String(e) };
+  }
+}
+
+// src/statusline-invalidate.ts
+var import_node_child_process11 = require("node:child_process");
 function invalidateStatuslineBoardCache() {
   try {
-    const child2 = (0, import_node_child_process10.spawn)("jerv-cli", ["lane", "ops", "invalidate-board"], {
+    const child2 = (0, import_node_child_process11.spawn)("jerv-cli", ["lane", "ops", "invalidate-board"], {
       detached: true,
       stdio: "ignore",
       windowsHide: true
@@ -23651,36 +23815,36 @@ async function putTenantArtifact(repo, stage, inputPath, deps) {
 }
 
 // src/hotfix-coverage.ts
-var import_node_child_process11 = require("node:child_process");
+var import_node_child_process12 = require("node:child_process");
 var CHERRY_TRAILER = /\(cherry picked from commit ([0-9a-f]{7,40})\)/g;
 function checkHotfixCoverage(options = {}) {
   const { cwd = process.cwd(), mainRef = "origin/main", rcRef = "origin/rc", manifestPaths = [] } = options;
   const ack = (options.ack ?? []).filter(Boolean);
-  const git2 = options.git ?? ((args, opts) => (0, import_node_child_process11.execFileSync)("git", args, { cwd, encoding: "utf8", input: opts?.input, stdio: ["pipe", "pipe", "pipe"] }));
+  const git3 = options.git ?? ((args, opts) => (0, import_node_child_process12.execFileSync)("git", args, { cwd, encoding: "utf8", input: opts?.input, stdio: ["pipe", "pipe", "pipe"] }));
   const revList = (range) => {
-    const out = git2(["rev-list", "--no-merges", range]).trim();
+    const out = git3(["rev-list", "--no-merges", range]).trim();
     return out ? out.split("\n") : [];
   };
   const isAncestor = (sha, ref) => {
     try {
-      git2(["merge-base", "--is-ancestor", sha, ref]);
+      git3(["merge-base", "--is-ancestor", sha, ref]);
       return true;
     } catch {
       return false;
     }
   };
   const patchId = (sha) => {
-    const diff = git2(["show", "--no-color", "--pretty=format:", sha]);
+    const diff = git3(["show", "--no-color", "--pretty=format:", sha]);
     if (!diff.trim()) return null;
-    const out = git2(["patch-id", "--stable"], { input: diff }).trim();
+    const out = git3(["patch-id", "--stable"], { input: diff }).trim();
     return out ? out.split(" ")[0] : null;
   };
   const changedPaths = (sha) => {
-    const out = git2(["show", "--no-color", "--name-only", "--pretty=format:", sha]).trim();
+    const out = git3(["show", "--no-color", "--name-only", "--pretty=format:", sha]).trim();
     return out ? out.split("\n") : [];
   };
   const cherrySources = (sha) => {
-    const message = git2(["log", "-1", "--format=%B", sha]);
+    const message = git3(["log", "-1", "--format=%B", sha]);
     return [...message.matchAll(CHERRY_TRAILER)].map((m) => m[1]);
   };
   const mainOnly = revList(`${rcRef}..${mainRef}`);
@@ -23695,7 +23859,7 @@ function checkHotfixCoverage(options = {}) {
     }
   };
   const commits = mainOnly.map((sha) => {
-    const subject = git2(["log", "-1", "--format=%s", sha]).trim();
+    const subject = git3(["log", "-1", "--format=%s", sha]).trim();
     const paths = changedPaths(sha);
     if (paths.length > 0 && paths.every((p) => manifestPaths.includes(p))) {
       return { sha, subject, coverage: "exempt-distribution" };
@@ -23724,21 +23888,21 @@ function checkHotfixCoverage(options = {}) {
 }
 function checkHotfixCarries(options) {
   const { cwd = process.cwd(), branch, baseRef, targets } = options;
-  const git2 = options.git ?? ((args, opts) => (0, import_node_child_process11.execFileSync)("git", args, { cwd, encoding: "utf8", input: opts?.input, stdio: ["pipe", "pipe", "pipe"] }));
+  const git3 = options.git ?? ((args, opts) => (0, import_node_child_process12.execFileSync)("git", args, { cwd, encoding: "utf8", input: opts?.input, stdio: ["pipe", "pipe", "pipe"] }));
   const isAncestor = (sha, ref) => {
     try {
-      git2(["merge-base", "--is-ancestor", sha, ref]);
+      git3(["merge-base", "--is-ancestor", sha, ref]);
       return true;
     } catch {
       return false;
     }
   };
   const revList = (range) => {
-    const out = git2(["rev-list", "--no-merges", range]).trim();
+    const out = git3(["rev-list", "--no-merges", range]).trim();
     return out ? out.split("\n") : [];
   };
   const cherrySources = (sha) => {
-    const message = git2(["log", "-1", "--format=%B", sha]);
+    const message = git3(["log", "-1", "--format=%B", sha]);
     return [...message.matchAll(CHERRY_TRAILER)].map((m) => m[1]);
   };
   const carried = /* @__PURE__ */ new Set();
@@ -24821,7 +24985,7 @@ function renderDeployPortDoctor(report) {
 }
 
 // src/spawn-policy-core.ts
-var import_node_child_process12 = require("node:child_process");
+var import_node_child_process13 = require("node:child_process");
 var import_node_fs24 = require("node:fs");
 var import_node_path21 = require("node:path");
 var SPAWNERS = ["spawn", "spawnSync", "exec", "execSync", "execFile", "execFileSync"];
@@ -24892,7 +25056,7 @@ function findViolationsInSource(raw) {
   return found;
 }
 function policedFiles(root) {
-  const r = (0, import_node_child_process12.spawnSync)("git", ["ls-files", "-z", "--cached", "--others", "--exclude-standard"], {
+  const r = (0, import_node_child_process13.spawnSync)("git", ["ls-files", "-z", "--cached", "--others", "--exclude-standard"], {
     cwd: root,
     encoding: "utf8",
     windowsHide: true,
@@ -24926,12 +25090,25 @@ function runSpawnPolicy(root) {
 }
 
 // src/test-policy-core.ts
-var import_node_child_process13 = require("node:child_process");
+var import_node_child_process15 = require("node:child_process");
 var import_node_fs25 = require("node:fs");
 var import_node_path22 = require("node:path");
 
 // ../scripts/test-command-policy-core.mjs
+var import_node_child_process14 = require("node:child_process");
 var TEST_COMMAND_CLASS = "test";
+var TRAILER_KEY = "Test-Policy-Override";
+var OVERRIDE_RE = /^Test-Policy-Override:\s*(.+)$/im;
+var REC = "";
+var FLD = "";
+var WAIVABLE_KINDS = [
+  "mandatory-zone-untested",
+  "unrequested-test-file",
+  "protected-removed",
+  "stale-protected-entry",
+  "stale-satisfied-by"
+];
+var TEST_WORK_KIND = "unrequested-test-file";
 function translateGlob(glob) {
   let out = "";
   for (let i = 0; i < glob.length; i += 1) {
@@ -24974,7 +25151,7 @@ function matchedMandatoryGlobs(paths, mandatory) {
     return list.some((path2) => re.test(path2));
   });
 }
-function evaluateTestCommandPolicy({ paths, mandatory, regulated = true } = {}) {
+function evaluateTestCommandPolicy({ paths, mandatory, regulated = true, override = null } = {}) {
   const configuredMandatoryCount = mandatoryGlobList(mandatory).length;
   if (!regulated) {
     return {
@@ -24987,7 +25164,8 @@ function evaluateTestCommandPolicy({ paths, mandatory, regulated = true } = {})
     };
   }
   const matched = matchedMandatoryGlobs(paths, mandatory);
-  const testCommandsAllowed = matched.length > 0;
+  const overrideAuthorizes = Array.isArray(override?.kinds) && override.kinds.includes(TEST_WORK_KIND);
+  const testCommandsAllowed = matched.length > 0 || overrideAuthorizes;
   return {
     configuredMandatoryCount,
     matchedMandatoryGlobs: matched,
@@ -25000,22 +25178,78 @@ function evaluateTestCommandPolicy({ paths, mandatory, regulated = true } = {})
     }
   };
 }
+function git(args, cwd) {
+  return (0, import_node_child_process14.execFileSync)("git", args, { windowsHide: true, cwd, encoding: "utf8", maxBuffer: 32 * 1024 * 1024 });
+}
+function parseScope(value) {
+  const scoped = /^\[([^\]]*)\]\s*([\s\S]*)$/.exec(value);
+  if (!scoped) return { kinds: [...WAIVABLE_KINDS], reason: value, unknown: [] };
+  const named = scoped[1].split(",").map((k) => k.trim()).filter(Boolean);
+  return {
+    kinds: named,
+    reason: scoped[2].trim(),
+    unknown: named.filter((k) => !WAIVABLE_KINDS.includes(k))
+  };
+}
+function invisibleTrailer(sha, line) {
+  return {
+    kind: "malformed-override-trailer",
+    paths: [],
+    detail: `OVERRIDE TRAILER GIT CANNOT SEE \u2014 commit ${sha.slice(0, 8)} carries
+    ${line}
+  but \`git log --format='%(trailers:key=${TRAILER_KEY})'\` reports nothing for it, so the waiver would
+  exist only to the regex that granted it. The trailer was chosen over a flag because it can be
+  AUDITED, and a reason the auditor cannot see is not a reason this gate accepts (#3628).
+  Git reads trailers from the LAST paragraph only, and every line of that paragraph must be a
+  trailer or an indented continuation \u2014 one bare line such as \`Closes #123\` disqualifies the whole
+  block. Indent the continuation lines, and leave nothing but trailers in that paragraph.
+  This is fixable forward: push a LATER commit on this branch carrying a well-formed trailer.
+  The nearest waiver wins, and it supersedes this one \u2014 no force-push, no re-filed branch.`
+  };
+}
+function unknownScope(sha, unknown) {
+  return {
+    kind: "malformed-override-trailer",
+    paths: [],
+    detail: `UNKNOWN OVERRIDE SCOPE \u2014 commit ${sha.slice(0, 8)} scopes its waiver to ${unknown.join(", ")}, which this
+  gate cannot report.
+  Waivable kinds: ${WAIVABLE_KINDS.join(", ")}.
+  Refused rather than widened: treating a typo as "waive everything" is how a scoped waiver turns
+  into a blanket exemption without anyone deciding it should.`
+  };
+}
+function isShallowRepository(cwd) {
+  try {
+    return git(["rev-parse", "--is-shallow-repository"], cwd).trim() !== "false";
+  } catch {
+    return true;
+  }
+}
+function readOverride(base, cwd) {
+  const format = `%H${FLD}%(trailers:key=${TRAILER_KEY},valueonly,unfold)${FLD}%B${REC}`;
+  const refusals = [];
+  let override = null;
+  for (const record of git(["log", `${base}..HEAD`, `--format=${format}`], cwd).split(REC)) {
+    const [sha, trailer, body] = record.replace(/^\s+/, "").split(FLD);
+    if (!sha) continue;
+    if (override) break;
+    const value = (trailer ?? "").trim();
+    if (!value) {
+      const shaped = OVERRIDE_RE.exec(body ?? "");
+      if (shaped) refusals.push(invisibleTrailer(sha, shaped[0].trim()));
+      continue;
+    }
+    const { kinds, reason, unknown } = parseScope(value);
+    if (unknown.length > 0) refusals.push(unknownScope(sha, unknown));
+    else override = { sha, reason, kinds };
+  }
+  return { override, refusals };
+}
 
 // src/test-policy-core.ts
 var POLICY_FILE = "test-policy.json";
 var TEST_RE = /\.(?:test|spec)\.[cm]?[jt]sx?$/;
 var PY_TEST_RE = /(?:^|\/)test_[^/]*\.py$|_test\.py$/;
-var TRAILER_KEY = "Test-Policy-Override";
-var OVERRIDE_RE = /^Test-Policy-Override:\s*(.+)$/im;
-var REC = "";
-var FLD = "";
-var WAIVABLE_KINDS = [
-  "mandatory-zone-untested",
-  "unrequested-test-file",
-  "protected-removed",
-  "stale-protected-entry",
-  "stale-satisfied-by"
-];
 function translate(glob) {
   let out = "";
   for (let i = 0; i < glob.length; i++) {
@@ -25373,15 +25607,15 @@ function evaluate(changed, policy, present = () => false) {
   }
   return findings;
 }
-function git(args, cwd) {
-  return (0, import_node_child_process13.execFileSync)("git", args, { windowsHide: true, cwd, encoding: "utf8", maxBuffer: 32 * 1024 * 1024 });
+function git2(args, cwd) {
+  return (0, import_node_child_process15.execFileSync)("git", args, { windowsHide: true, cwd, encoding: "utf8", maxBuffer: 32 * 1024 * 1024 });
 }
 var COAUTHOR_KEY = "Co-authored-by";
 var GH_MESSAGE_SEPARATOR = /^-{5,}$/;
 var LIFTED_KEYS = new RegExp(`^(?:${TRAILER_KEY}|${COAUTHOR_KEY}):`, "i");
 function parseTrailers(message, cwd) {
   try {
-    return (0, import_node_child_process13.execFileSync)("git", ["interpret-trailers", "--parse", "--unfold"], {
+    return (0, import_node_child_process15.execFileSync)("git", ["interpret-trailers", "--parse", "--unfold"], {
       windowsHide: true,
       cwd,
       input: message,
@@ -25418,19 +25652,12 @@ function resolveBase(cwd, explicit) {
   const candidates = [explicit, process.env.TEST_POLICY_BASE, "origin/development", "origin/main"].filter(Boolean);
   for (const ref of candidates) {
     try {
-      return git(["merge-base", "HEAD", ref], cwd).trim();
+      return git2(["merge-base", "HEAD", ref], cwd).trim();
     } catch {
     }
   }
   return null;
 }
-function isShallowRepository(cwd) {
-  try {
-    return git(["rev-parse", "--is-shallow-repository"], cwd).trim() !== "false";
-  } catch {
-    return true;
-  }
-}
 function untrustworthyRange(cwd, base) {
   if (!base) {
     return {
@@ -25452,65 +25679,11 @@ function untrustworthyRange(cwd, base) {
   Fetch full history \u2014 actions/checkout with \`fetch-depth: 0\`, or \`git fetch --unshallow\`.`
   };
 }
-function parseScope(value) {
-  const scoped = /^\[([^\]]*)\]\s*([\s\S]*)$/.exec(value);
-  if (!scoped) return { kinds: [...WAIVABLE_KINDS], reason: value, unknown: [] };
-  const named = scoped[1].split(",").map((k) => k.trim()).filter(Boolean);
-  return {
-    kinds: named,
-    reason: scoped[2].trim(),
-    unknown: named.filter((k) => !WAIVABLE_KINDS.includes(k))
-  };
-}
-function invisibleTrailer(sha, line) {
-  return {
-    kind: "malformed-override-trailer",
-    paths: [],
-    detail: `OVERRIDE TRAILER GIT CANNOT SEE \u2014 commit ${sha.slice(0, 8)} carries
-    ${line}
-  but \`git log --format='%(trailers:key=${TRAILER_KEY})'\` reports nothing for it, so the waiver would
-  exist only to the regex that granted it. The trailer was chosen over a flag because it can be
-  AUDITED, and a reason the auditor cannot see is not a reason this gate accepts (#3628).
-  Git reads trailers from the LAST paragraph only, and every line of that paragraph must be a
-  trailer or an indented continuation \u2014 one bare line such as \`Closes #123\` disqualifies the whole
-  block. Indent the continuation lines, and leave nothing but trailers in that paragraph.
-  This is fixable forward: push a LATER commit on this branch carrying a well-formed trailer.
-  The nearest waiver wins, and it supersedes this one \u2014 no force-push, no re-filed branch.`
-  };
-}
-function unknownScope(sha, unknown) {
-  return {
-    kind: "malformed-override-trailer",
-    paths: [],
-    detail: `UNKNOWN OVERRIDE SCOPE \u2014 commit ${sha.slice(0, 8)} scopes its waiver to ${unknown.join(", ")}, which this
-  gate cannot report.
-  Waivable kinds: ${WAIVABLE_KINDS.join(", ")}.
-  Refused rather than widened: treating a typo as "waive everything" is how a scoped waiver turns
-  into a blanket exemption without anyone deciding it should.`
-  };
-}
-function readOverride(base, cwd) {
-  const format = `%H${FLD}%(trailers:key=${TRAILER_KEY},valueonly,unfold)${FLD}%B${REC}`;
-  const refusals = [];
-  let override = null;
-  for (const record of git(["log", `${base}..HEAD`, `--format=${format}`], cwd).split(REC)) {
-    const [sha, trailer, body] = record.replace(/^\s+/, "").split(FLD);
-    if (!sha) continue;
-    if (override) break;
-    const value = (trailer ?? "").trim();
-    if (!value) {
-      const shaped = OVERRIDE_RE.exec(body ?? "");
-      if (shaped) refusals.push(invisibleTrailer(sha, shaped[0].trim()));
-      continue;
-    }
-    const { kinds, reason, unknown } = parseScope(value);
-    if (unknown.length > 0) refusals.push(unknownScope(sha, unknown));
-    else override = { sha, reason, kinds };
-  }
-  return { override, refusals };
+function readOverride2(base, cwd) {
+  return readOverride(base, cwd);
 }
 function changedFilesSince(base, cwd) {
-  const raw = git(["diff", "--name-status", "-M", base, "--"], cwd).trim();
+  const raw = git2(["diff", "--name-status", "-M", base, "--"], cwd).trim();
   const changed = raw ? raw.split("\n").map((line) => {
     const parts = line.split("	");
     const norm = (p) => p.replace(/\\/g, "/");
@@ -25518,12 +25691,12 @@ function changedFilesSince(base, cwd) {
     if (parts.length > 2) row.from = norm(parts[1]);
     return row;
   }) : [];
-  const untracked = git(["ls-files", "--others", "--exclude-standard", "-z"], cwd).split("\0").filter(Boolean).map((path2) => ({ status: "A", path: path2.replace(/\\/g, "/") }));
+  const untracked = git2(["ls-files", "--others", "--exclude-standard", "-z"], cwd).split("\0").filter(Boolean).map((path2) => ({ status: "A", path: path2.replace(/\\/g, "/") }));
   return [...changed, ...untracked];
 }
 function blobAt(base, path2, cwd) {
   try {
-    return git(["show", `${base}:${path2}`], cwd);
+    return git2(["show", `${base}:${path2}`], cwd);
   } catch {
     return null;
   }
@@ -25539,7 +25712,7 @@ function runTestPolicy(root, deps = {}) {
     before: blobAt(base, path2, root),
     after: readFileOrNull2((0, import_node_path22.join)(root, path2))
   }));
-  const lookup = deps.override !== void 0 ? { override: deps.override, refusals: [] } : !deps.changed && !refusal ? readOverride(base, root) : { override: null, refusals: [] };
+  const lookup = deps.override !== void 0 ? { override: deps.override, refusals: [] } : !deps.changed && !refusal ? readOverride2(base, root) : { override: null, refusals: [] };
   const present = (path2) => exists((0, import_node_path22.join)(root, path2));
   const removedByThisDiff = removedPaths(changed);
   const staleFindings = [];
@@ -25572,7 +25745,8 @@ function runTestPolicy(root, deps = {}) {
   const commandPolicy = evaluateTestCommandPolicy({
     paths: changed.map((f) => f.path),
     mandatory: policy.mandatory,
-    regulated: policy.declared !== false
+    regulated: policy.declared !== false,
+    override: override && lookup.refusals.length === 0 ? { kinds: override.kinds } : null
   });
   const result = {
     ok: findings.length === 0,
@@ -25594,7 +25768,7 @@ function runTestPolicy(root, deps = {}) {
 }
 
 // src/dist-drift.ts
-var import_node_child_process14 = require("node:child_process");
+var import_node_child_process16 = require("node:child_process");
 var import_node_crypto7 = require("node:crypto");
 var import_node_fs27 = require("node:fs");
 var import_node_os13 = require("node:os");
@@ -25739,7 +25913,7 @@ function bomPathFor(root) {
   }
 }
 function rebuildTo(packageRoot, outDir) {
-  (0, import_node_child_process14.execFileSync)(process.execPath, ["build.mjs"], {
+  (0, import_node_child_process16.execFileSync)(process.execPath, ["build.mjs"], {
     cwd: packageRoot,
     env: { ...process.env, MMI_DIST_OUTDIR: outDir },
     windowsHide: true,
@@ -27456,9 +27630,9 @@ ${SSH_RECIPE_AGENT_NOTE}`);
 
 // src/schedules-commands.ts
 var import_promises4 = require("node:fs/promises");
-var import_node_child_process15 = require("node:child_process");
+var import_node_child_process17 = require("node:child_process");
 var import_node_util7 = require("node:util");
-var execFileP5 = (0, import_node_util7.promisify)(import_node_child_process15.execFile);
+var execFileP5 = (0, import_node_util7.promisify)(import_node_child_process17.execFile);
 var AWS_REGION = "eu-central-1";
 var AWS_TIMEOUT_MS = 3e4;
 var AWS_RETRY_DELAY_MS = 1500;
@@ -29551,7 +29725,7 @@ function registerBootstrapCommands(program3) {
     }
     let seedPrUrl;
     if (o.execute && seedPlan.mode === "pr" && seedPlan.branch && seededToBranch > 0) {
-      await gh(["api", "-X", "PATCH", `repos/${repo}`, "-f", "allow_auto_merge=true", "-f", "allow_squash_merge=true", "-f", "delete_branch_on_merge=true"]).catch(() => {
+      await gh(["api", "-X", "PATCH", `repos/${repo}`, "-f", "allow_auto_merge=true", "-f", "allow_squash_merge=true", "-F", `delete_branch_on_merge=${MANAGED_DELETE_BRANCH_ON_MERGE}`]).catch(() => {
       });
       const openPrs = await gh(["pr", "list", "--repo", repo, "--head", seedPlan.branch, "--base", baseBranch, "--state", "open", "--json", "number,url"]);
       const prDecision = decideSeedPrAction(JSON.parse(openPrs.stdout || "[]"));
@@ -29600,8 +29774,8 @@ ${onlyManagedBlock ? `Only the marker-bounded Hub-managed block inside repo-owne
     }
     if (o.execute && !onlyTarget && o.class === "deployable") {
       try {
-        await gh(["api", "-X", "PATCH", `repos/${repo}`, "-f", "allow_auto_merge=true", "-f", "allow_squash_merge=true", "-f", "delete_branch_on_merge=true"]);
-        applied.push("merge settings: allow_auto_merge, squash, delete-branch-on-merge");
+        await gh(["api", "-X", "PATCH", `repos/${repo}`, "-f", "allow_auto_merge=true", "-f", "allow_squash_merge=true", "-F", `delete_branch_on_merge=${MANAGED_DELETE_BRANCH_ON_MERGE}`]);
+        applied.push("merge settings: allow_auto_merge, squash, preserve merged remote branches");
       } catch (e) {
         applied.push(`merge settings (failed: ${e.message})`);
       }
@@ -30784,6 +30958,9 @@ function buildPrMergeArgs(input) {
   if (input.auto) args.push("--auto");
   return args;
 }
+function buildPrDisableAutoArgs(input) {
+  return ["pr", "merge", input.number, ...input.repoArgs, "--disable-auto"];
+}
 function basePolicyBlocksImmediateMerge(message) {
   return /base branch policy prohibits|protected branch|required status check|merge queue/i.test(message);
 }
@@ -30794,6 +30971,12 @@ function ghPrMergeLocalBranchDeleteWarning(message) {
 function mergeAutoRejectedPrAlreadyClean(message) {
   return /clean status \(enablePullRequestAutoMerge\)|is in clean status/i.test(message);
 }
+function assertRemoteBranchPreservedOnMerge(repo, deleteBranchOnMerge) {
+  if (deleteBranchOnMerge === false) return;
+  throw new Error(
+    `pr merge: ${repo} does not prove delete_branch_on_merge=false. Automatic deletion can irreversibly close stacked PRs. Run \`mmi-cli devops ci reconcile --repo ${repo} --apply\`, then retry; remote branch cleanup is delayed.`
+  );
+}
 function mergeMethodFromParentCount(parentCount) {
   if (parentCount >= 2) return "merge";
   return void 0;
@@ -31043,6 +31226,7 @@ async function remoteBranchExists2(branch, options = {}) {
 
 // src/worktree-merge-cleanup.ts
 var import_node_fs36 = require("node:fs");
+var import_node_path34 = require("node:path");
 
 // src/worktree-evidence-archive.ts
 var import_node_fs35 = require("node:fs");
@@ -31221,6 +31405,18 @@ function formatArtifactsArchiveReceipt(archive) {
 function normPath2(p) {
   return p.replace(/\\/g, "/").replace(/\/+$/, "");
 }
+function removeResidueDirectory(wtPath) {
+  try {
+    try {
+      if ((0, import_node_fs36.lstatSync)((0, import_node_path34.join)(wtPath, "node_modules")).isSymbolicLink()) (0, import_node_fs36.rmdirSync)((0, import_node_path34.join)(wtPath, "node_modules"));
+    } catch {
+    }
+    (0, import_node_fs36.rmSync)(wtPath, { recursive: true, force: true, maxRetries: 10, retryDelay: 100 });
+    return { ok: true };
+  } catch (e) {
+    return { ok: false, error: e instanceof Error ? e.message : String(e) };
+  }
+}
 function samePath(a, b) {
   const na = normPath2(a);
   const nb = normPath2(b);
@@ -31261,19 +31457,19 @@ function formatWorktreeRemovalFailureDetail(options) {
   const detail = options.removeError.trim() || "git worktree remove exited nonzero";
   return `${detail}; registered=${options.registered ? "yes" : "no"}; pathExists=${options.pathExists ? "yes" : "no"}; path=${options.wtPath}`;
 }
-async function resolveMergeBaseTimestampMs(git2, baseRef, branch) {
+async function resolveMergeBaseTimestampMs(git3, baseRef, branch) {
   try {
-    const mergeBase = (await git2(["merge-base", baseRef, branch])).trim();
+    const mergeBase = (await git3(["merge-base", baseRef, branch])).trim();
     if (!mergeBase) return 0;
-    const sec = parseCommitTimestampSec(await git2(["show", "-s", "--format=%ct", mergeBase]));
+    const sec = parseCommitTimestampSec(await git3(["show", "-s", "--format=%ct", mergeBase]));
     return sec ? sec * 1e3 : 0;
   } catch {
     return 0;
   }
 }
-async function verifyBranchHead(git2, branch, expectedHeadOid) {
+async function verifyBranchHead(git3, branch, expectedHeadOid) {
   if (!expectedHeadOid) return { ok: false, reason: "branch-head-unverified" };
-  const currentHead = (await git2(["rev-parse", `refs/heads/${branch}`]).catch(() => "") || "").trim();
+  const currentHead = (await git3(["rev-parse", `refs/heads/${branch}`]).catch(() => "") || "").trim();
   if (!currentHead) return { ok: false, reason: "branch-head-unverified" };
   if (currentHead !== expectedHeadOid) {
     return { ok: false, reason: "unpushed-branch", error: `${currentHead} != ${expectedHeadOid}` };
@@ -31288,17 +31484,17 @@ async function teardownWorktreeStage(worktreePath) {
     return { status: "failed", error: e instanceof Error ? e.message : String(e) };
   }
 }
-async function removeWorktreeWithReconcile(wtPath, git2, listWorktrees, pathExists) {
+async function removeWorktreeWithReconcile(wtPath, git3, listWorktrees, pathExists) {
   const attemptRemove = async () => {
     try {
-      await git2(["worktree", "remove", "--force", wtPath]);
+      await git3(["worktree", "remove", "--force", wtPath]);
       return void 0;
     } catch (e) {
       return formatGitCommandError(e);
     }
   };
   const pruneAndVerify = async (reason) => {
-    await git2(["worktree", "prune"]).catch(() => "");
+    await git3(["worktree", "prune"]).catch(() => "");
     let worktrees2;
     try {
       worktrees2 = await listWorktrees();
@@ -31328,6 +31524,16 @@ async function removeWorktreeWithReconcile(wtPath, git2, listWorktrees, pathExis
     };
   }
   if (!isWorktreePathRegistered(worktrees, wtPath)) return pruneAndVerify("reconciled-unregistered");
+  await git3(["worktree", "prune"]).catch(() => "");
+  try {
+    worktrees = await listWorktrees();
+  } catch (e) {
+    return {
+      status: "failed",
+      error: `could not verify worktree registration after prune: ${formatGitCommandError(e)}; path=${wtPath}`
+    };
+  }
+  if (!isWorktreePathRegistered(worktrees, wtPath)) return pruneAndVerify("reconciled-pruned");
   const retryError = await attemptRemove();
   if (!retryError) return pruneAndVerify("reconciled-after-retry");
   if (isNotAWorkingTreeMessage(retryError) || isNotAWorkingTreeMessage(firstError)) {
@@ -31405,8 +31611,8 @@ async function cleanupPrMergeLocalBranch(branch, options) {
     return report;
   }
   const safeCwd = selectSafeWorktreeCwd([...afterWorktrees, ...beforeWorktrees], wtPath, { pathExists });
-  const git2 = (args) => safeCwd ? execGit(["-C", safeCwd, ...args]) : execGit(args);
-  const headCheck = await verifyBranchHead(git2, branch, options.expectedHeadOid);
+  const git3 = (args) => safeCwd ? execGit(["-C", safeCwd, ...args]) : execGit(args);
+  const headCheck = await verifyBranchHead(git3, branch, options.expectedHeadOid);
   if (!headCheck.ok) {
     report.localBranch = {
       name: branch,
@@ -31469,8 +31675,8 @@ async function cleanupPrMergeLocalBranch(branch, options) {
   }
   const removal = await removeWorktreeWithReconcile(
     wtPath,
-    git2,
-    async () => parseGitWorktreePorcelain(await git2(["worktree", "list", "--porcelain"])),
+    git3,
+    async () => parseGitWorktreePorcelain(await git3(["worktree", "list", "--porcelain"])),
     pathExists
   );
   if (removal.status === "failed") {
@@ -31493,11 +31699,20 @@ async function cleanupPrMergeLocalBranch(branch, options) {
     stageTeardown,
     tmpEvidenceCount: tmpEvidence.length
   };
+  if (pathExists(wtPath)) {
+    const residue = options.removeResidueDir?.(wtPath) ?? removeResidueDirectory(wtPath);
+    if (residue.ok) {
+      report.worktree.residue = "swept";
+    } else {
+      report.worktree.residue = "left";
+      report.worktree.residueError = residue.error;
+    }
+  }
   try {
-    await git2(["branch", "-D", branch]);
+    await git3(["branch", "-D", branch]);
     report.localBranch = { name: branch, status: "deleted" };
   } catch (e) {
-    const remaining = await git2(["branch", "--list", branch]).catch(() => "");
+    const remaining = await git3(["branch", "--list", branch]).catch(() => "");
     report.localBranch = remaining.trim() ? { name: branch, status: "failed", error: e instanceof Error ? e.message : String(e) } : { name: branch, status: "already-gone" };
   }
   return report;
@@ -31520,6 +31735,9 @@ function renderPrMergeCleanupLines(cleanup) {
   } else if (wt.status === "preserved") {
     lines.push(`pr merge: preserved worktree ${wt.path} (--preserve-worktree)`);
   }
+  if (wt.residue === "left") {
+    lines.push(`pr merge: worktree ${wt.path} registration is gone but residue remains \u2014 delete by hand: ${wt.residueError ?? wt.path}`);
+  }
   if (wt.artifactsArchive?.status === "archived" && wt.artifactsArchive.path) {
     lines.push(`pr merge: archived worktree evidence to ${wt.artifactsArchive.path}`);
   } else if (wt.artifactsArchive?.status === "blocked" && wt.artifactsArchive.error) {
@@ -31528,6 +31746,17 @@ function renderPrMergeCleanupLines(cleanup) {
   return lines;
 }
 
+// src/utf8-receipt.ts
+var import_node_fs37 = require("node:fs");
+var import_node_path35 = require("node:path");
+function writeUtf8Receipt(path2, text) {
+  (0, import_node_fs37.mkdirSync)((0, import_node_path35.dirname)(path2), { recursive: true });
+  const body = text.endsWith("\n") ? text : `${text}
+`;
+  (0, import_node_fs37.writeFileSync)(path2, body, "utf8");
+  return Buffer.byteLength(body, "utf8");
+}
+
 // src/board-commands.ts
 function refuseRateLimited(e, json) {
   if (!isRateLimitedError(e)) return false;
@@ -31555,7 +31784,9 @@ function registerBoardCommands(program3) {
         includeAllBodies: o.bodies,
         allowPartial: o.allowPartial
       }, o.direct ? {} : { snapshot: registryClientDeps(config) });
-      console.log(o.json ? JSON.stringify(report) : renderBoardReport(report));
+      const output = o.json ? JSON.stringify(report) : renderBoardReport(report);
+      if (!o.out) console.log(output);
+      else console.log(`Wrote board read to ${o.out} (UTF-8, ${writeUtf8Receipt(o.out, output)} bytes)`);
     } catch (e) {
       return failGraceful(`board read failed: ${withDiscoverMissDetail(e.message)}`);
     }
@@ -31564,7 +31795,7 @@ function registerBoardCommands(program3) {
     return alreadyClaimed ? `Check ${ref}: claimed and In Progress, no live contest - claim would renew the lease (nothing written)` : `Check ${ref}: free - claim would proceed (nothing written)`;
   }
   const board = program3.command("board").description("read, claim, show, and move Project v2 work items for the current repo");
-  board.command("read", { isDefault: true }).description("read the board and print user-owned, claimable, and taken items").option("--json", "machine-readable output").option("--repo <owner/repo>", "current repo (defaults to git origin)").option("--direct", "bypass the Hub snapshot and read the live board through direct GitHub GraphQL").option("--bundle-details", "fetch body/comments only for user-owned and claimable issues").option("--bodies", "fetch body/comments for EVERY scoped row, including taken and unowned in-flight ones \u2014 for consumers that scope by Status rather than ownership (#4861); implies --bundle-details and costs one extra read per row").option("--allow-partial", "return partial board results when later page/detail reads fail").addHelpText("after", "\nread is always the authoritative live GitHub Project v2 board (#4926).\n--direct skips the Hub snapshot and uses the existing direct GitHub GraphQL read immediately.\n--allow-partial applies to the paginated path and detail reads.\n").action((o) => runBoardRead(o));
+  board.command("read", { isDefault: true }).description("read the board and print user-owned, claimable, and taken items").option("--json", "machine-readable output").option("--repo <owner/repo>", "current repo (defaults to git origin)").option("--direct", "bypass the Hub snapshot and read the live board through direct GitHub GraphQL").option("--bundle-details", "fetch body/comments only for user-owned and claimable issues").option("--bodies", "fetch body/comments for EVERY scoped row, including taken and unowned in-flight ones \u2014 for consumers that scope by Status rather than ownership (#4861); implies --bundle-details and costs one extra read per row").option("--allow-partial", "return partial board results when later page/detail reads fail").option("--out <path>", "write the output to this file as UTF-8 (no BOM) instead of stdout \u2014 the shell-free receipt path (#5802)").addHelpText("after", "\nread is always the authoritative live GitHub Project v2 board (#4926).\n--direct skips the Hub snapshot and uses the existing direct GitHub GraphQL read immediately.\n--allow-partial applies to the paginated path and detail reads.\n\nNever capture the JSON with a shell redirect on Windows: PowerShell 5.1's `> file.json` is Out-File,\nwhich writes UTF-16LE with a BOM, and Node reading it as 'utf8' then fails JSON.parse at position 1\n(#5802). Use --out instead \u2014 the CLI writes the file itself as UTF-8:\n  mmi-cli oracle board read --json --out .jerv/tmp/board.json\n").action((o) => runBoardRead(o));
   withExamples(mutating(
     board.command("claim <issues...>").description("claim issues: assign them and move their Project v2 Status to In Progress \u2014 idempotent, so an item already yours and In Progress succeeds unchanged (one or more refs)").addHelpText("after", "\nevery claim stamps a lane-identity marker comment on the issue (`<!-- mmi-claim: \u2026 -->`,\nsurface/session@host) so other agents can attribute the hold (#3727). The session is the\nhost-exported id when the surface provides one, otherwise a per-process `synth-` fallback \u2014\na claim is never anonymous (#5245). `board show`, doctor and unclaim read the latest marker.\n").option("--json", "machine-readable output").option("--repo <owner/repo>", "current repo for local issue numbers (defaults to git origin)").option("--for <login>", "assign to this login instead of @me \u2014 agent claims on behalf of the master").option("--force", "take an item already claimed by another lane that shows live evidence of active work (#3727)").option("--check", "read-only: run every claim gate and report the verdict, writing nothing \u2014 exits 1 with the same refusal a real claim would raise (#4511)").option("--allow-partial", "return success JSON if assignment succeeds but the status move fails"),
     (_opts, args) => ({ command: "board claim", issues: args[0] ?? [] })
@@ -32227,7 +32458,7 @@ async function checkDocsIndexAtHead(opts, deps) {
 }
 
 // src/issue-commands.ts
-var import_node_fs37 = require("node:fs");
+var import_node_fs38 = require("node:fs");
 var import_node_crypto11 = require("node:crypto");
 
 // src/learning-closure-rate.ts
@@ -32414,7 +32645,7 @@ async function editIssue(client, options, deps = {}) {
   const url = `https://github.com/${repo}/issues/${parsed.number}`;
   const patch = {};
   let bodyChanged = false;
-  const textDeps = () => deps.textDeps ?? { readFile: (p, e) => Promise.resolve((0, import_node_fs37.readFileSync)(p, e)), readStdin: () => Promise.resolve("") };
+  const textDeps = () => deps.textDeps ?? { readFile: (p, e) => Promise.resolve((0, import_node_fs38.readFileSync)(p, e)), readStdin: () => Promise.resolve("") };
   if (options.titleFile !== void 0) {
     patch.title = await resolveIssueTitle({ title: options.title, titleFile: options.titleFile }, textDeps());
   } else if (options.title !== void 0) {
@@ -33031,7 +33262,7 @@ function extendCreateCommand(issue2, batchAttach) {
     if (opts.batch) {
       let specs;
       try {
-        const raw = (0, import_node_fs37.readFileSync)(opts.batch, "utf8");
+        const raw = (0, import_node_fs38.readFileSync)(opts.batch, "utf8");
         specs = JSON.parse(raw);
         if (!Array.isArray(specs)) throw new Error("batch file must contain a JSON array");
       } catch (e) {
@@ -33106,8 +33337,8 @@ ${lines}`, {
 }
 
 // src/train-commands.ts
-var import_node_fs38 = require("node:fs");
-var import_node_path34 = require("node:path");
+var import_node_fs39 = require("node:fs");
+var import_node_path36 = require("node:path");
 var RELEASE_BUMP_INTENTS = ["major", "minor", "patch"];
 function resolveReleaseBumpIntent(raw) {
   const intent = typeof raw === "string" ? raw.trim() : "";
@@ -33118,7 +33349,7 @@ function resolveReleaseBumpIntent(raw) {
 }
 function readRepoVersion() {
   try {
-    return JSON.parse((0, import_node_fs38.readFileSync)((0, import_node_path34.join)(process.cwd(), ".claude-plugin", "plugin.json"), "utf8")).version || void 0;
+    return JSON.parse((0, import_node_fs39.readFileSync)((0, import_node_path36.join)(process.cwd(), ".claude-plugin", "plugin.json"), "utf8")).version || void 0;
   } catch {
     return void 0;
   }
@@ -33275,9 +33506,9 @@ function registerDeployCommands(program3) {
 }
 
 // src/discovery-commands.ts
-var import_node_fs39 = require("node:fs");
+var import_node_fs40 = require("node:fs");
 var import_node_os17 = require("node:os");
-var import_node_path35 = require("node:path");
+var import_node_path37 = require("node:path");
 var GC_GH_TIMEOUT_MS2 = 2e4;
 async function collectStatus() {
   const repo = await resolveRepo();
@@ -33467,8 +33698,8 @@ async function collectOnboardStatus(opts = {}) {
   }
   const home = (0, import_node_os17.homedir)();
   const plugin = onboardPluginGate({
-    readKnown: () => readFileSyncSafe((0, import_node_path35.join)(home, ...KNOWN_MARKETPLACES_RELATIVE), import_node_fs39.readFileSync),
-    readSettings: () => readFileSyncSafe((0, import_node_path35.join)(home, ".claude", "settings.json"), import_node_fs39.readFileSync)
+    readKnown: () => readFileSyncSafe((0, import_node_path37.join)(home, ...KNOWN_MARKETPLACES_RELATIVE), import_node_fs40.readFileSync),
+    readSettings: () => readFileSyncSafe((0, import_node_path37.join)(home, ".claude", "settings.json"), import_node_fs40.readFileSync)
   });
   return { track, board, registry: registry2, secrets, plugin, doors: opts.doors ?? [], nextCommand };
 }
@@ -33777,7 +34008,10 @@ function findCommandInManifest(manifest, commandPath3) {
     return house ? houseRootAsParent(manifest, house) : void 0;
   }
   const visit = (command) => {
-    if (command.path === commandPath3 || command.flat_path === commandPath3) return command;
+    const aliasMatches = command.aliases?.some(
+      (alias) => [command.path, command.flat_path].some((path2) => `${path2.slice(0, path2.lastIndexOf(" ") + 1)}${alias}` === commandPath3)
+    );
+    if (command.path === commandPath3 || command.flat_path === commandPath3 || aliasMatches) return command;
     for (const child2 of command.subcommands) {
       const found = visit(child2);
       if (found) return found;
@@ -34228,8 +34462,8 @@ function registerPrLifecycleCommands(program3) {
 }
 
 // src/post-merge-recon.ts
-var import_node_fs40 = require("node:fs");
-var import_node_path36 = require("node:path");
+var import_node_fs41 = require("node:fs");
+var import_node_path38 = require("node:path");
 
 // src/cross-repo-filing-issue.ts
 function crossRepoFilingRetryCommand(prRepo, prNumber) {
@@ -34395,16 +34629,16 @@ function buildPostMergeReconRecovery(input) {
 }
 function writePostMergeReconRecovery(cwd, recovery) {
   const path2 = postMergeReconStatePath(cwd, recovery.repo, recovery.pr);
-  (0, import_node_fs40.mkdirSync)((0, import_node_path36.dirname)(path2), { recursive: true });
-  (0, import_node_fs40.writeFileSync)(path2, `${JSON.stringify(recovery, null, 2)}
+  (0, import_node_fs41.mkdirSync)((0, import_node_path38.dirname)(path2), { recursive: true });
+  (0, import_node_fs41.writeFileSync)(path2, `${JSON.stringify(recovery, null, 2)}
 `, "utf8");
   return path2;
 }
 function clearPostMergeReconRecovery(cwd, repo, pr2) {
   const path2 = postMergeReconStatePath(cwd, repo, pr2);
-  if (!(0, import_node_fs40.existsSync)(path2)) return;
+  if (!(0, import_node_fs41.existsSync)(path2)) return;
   try {
-    (0, import_node_fs40.unlinkSync)(path2);
+    (0, import_node_fs41.unlinkSync)(path2);
   } catch {
   }
 }
@@ -37461,17 +37695,17 @@ function parseOriginRepo(remoteUrl) {
 }
 function ghHostsConfigPath(env, platform2) {
   const sep3 = platform2 === "win32" ? "\\" : "/";
-  const join32 = (...parts) => parts.join(sep3);
+  const join33 = (...parts) => parts.join(sep3);
   const explicit = env.GH_CONFIG_DIR?.trim();
-  if (explicit) return join32(explicit, "hosts.yml");
+  if (explicit) return join33(explicit, "hosts.yml");
   if (platform2 === "win32") {
     const appData = (env.AppData ?? env.APPDATA)?.trim();
-    return appData ? join32(appData, "GitHub CLI", "hosts.yml") : void 0;
+    return appData ? join33(appData, "GitHub CLI", "hosts.yml") : void 0;
   }
   const xdg = env.XDG_CONFIG_HOME?.trim();
-  if (xdg) return join32(xdg, "gh", "hosts.yml");
+  if (xdg) return join33(xdg, "gh", "hosts.yml");
   const home = env.HOME?.trim();
-  return home ? join32(home, ".config", "gh", "hosts.yml") : void 0;
+  return home ? join33(home, ".config", "gh", "hosts.yml") : void 0;
 }
 function parseGhHostsAccounts(yaml, host = "github.com") {
   let hostIndent = null;
@@ -37521,10 +37755,10 @@ function ghAccountCaveat(announcedLogin, accounts) {
 }
 
 // src/doctor-io.ts
-var import_node_fs41 = require("node:fs");
+var import_node_fs42 = require("node:fs");
 var import_node_os18 = require("node:os");
-var import_node_path37 = require("node:path");
-var import_node_child_process16 = require("node:child_process");
+var import_node_path39 = require("node:path");
+var import_node_child_process18 = require("node:child_process");
 var import_node_util8 = require("node:util");
 
 // src/discard-sink.ts
@@ -37533,27 +37767,27 @@ function nodeDiscardSinkPath(platform2 = process.platform) {
 }
 
 // src/doctor-io.ts
-var execFileP6 = (0, import_node_util8.promisify)(import_node_child_process16.execFile);
+var execFileP6 = (0, import_node_util8.promisify)(import_node_child_process18.execFile);
 function execFileCapture(file, args, opts = {}) {
   const sink = nodeDiscardSinkPath();
-  const inFd = (0, import_node_fs41.openSync)(sink, "r");
-  const errFd = (0, import_node_fs41.openSync)(sink, "w");
+  const inFd = (0, import_node_fs42.openSync)(sink, "r");
+  const errFd = (0, import_node_fs42.openSync)(sink, "w");
   try {
-    return (0, import_node_child_process16.execFileSync)(file, args, {
+    return (0, import_node_child_process18.execFileSync)(file, args, {
       ...opts,
       encoding: "utf8",
       stdio: [inFd, "pipe", errFd]
     });
   } finally {
-    (0, import_node_fs41.closeSync)(inFd);
-    (0, import_node_fs41.closeSync)(errFd);
+    (0, import_node_fs42.closeSync)(inFd);
+    (0, import_node_fs42.closeSync)(errFd);
   }
 }
 var MMI_PLUGIN_ID2 = "mmi@mutmutco";
 function installedClaudePluginVersion() {
   try {
     const file = JSON.parse(
-      (0, import_node_fs41.readFileSync)((0, import_node_path37.join)((0, import_node_os18.homedir)(), ".claude", "plugins", "installed_plugins.json"), "utf8")
+      (0, import_node_fs42.readFileSync)((0, import_node_path39.join)((0, import_node_os18.homedir)(), ".claude", "plugins", "installed_plugins.json"), "utf8")
     );
     const versions = (file.plugins?.[MMI_PLUGIN_ID2] ?? []).map((r) => r.version).filter((v) => Boolean(v));
     if (versions.length === 0) return void 0;
@@ -37564,7 +37798,7 @@ function installedClaudePluginVersion() {
 }
 function manifestVersion(path2) {
   try {
-    const manifest = JSON.parse((0, import_node_fs41.readFileSync)(path2, "utf8"));
+    const manifest = JSON.parse((0, import_node_fs42.readFileSync)(path2, "utf8"));
     return typeof manifest.version === "string" && manifest.version.trim() ? manifest.version.trim() : void 0;
   } catch {
     return void 0;
@@ -37573,12 +37807,12 @@ function manifestVersion(path2) {
 function readHermesPluginEvidence(env = process.env) {
   const host = hermesConfigRoot(env);
   const root = hermesPluginRoot(env);
-  const installRecordPresent = (0, import_node_fs41.existsSync)(root);
-  const manifestPath = (0, import_node_path37.join)(root, "plugin.yaml");
+  const installRecordPresent = (0, import_node_fs42.existsSync)(root);
+  const manifestPath = (0, import_node_path39.join)(root, "plugin.yaml");
   let installedVersion;
   let manifest = "missing";
   try {
-    const text = (0, import_node_fs41.readFileSync)(manifestPath, "utf8");
+    const text = (0, import_node_fs42.readFileSync)(manifestPath, "utf8");
     let version;
     try {
       const parsed = JSON.parse(text).version;
@@ -37592,20 +37826,20 @@ function readHermesPluginEvidence(env = process.env) {
     if (version) {
       installedVersion = version;
       manifest = "valid";
-    } else if ((0, import_node_fs41.existsSync)(manifestPath)) manifest = "invalid";
+    } else if ((0, import_node_fs42.existsSync)(manifestPath)) manifest = "invalid";
   } catch {
-    if ((0, import_node_fs41.existsSync)(manifestPath)) manifest = "invalid";
+    if ((0, import_node_fs42.existsSync)(manifestPath)) manifest = "invalid";
   }
   let skills = false;
   try {
-    skills = (0, import_node_fs41.existsSync)((0, import_node_path37.join)(root, "skills")) && (0, import_node_fs41.statSync)((0, import_node_path37.join)(root, "skills")).isDirectory();
+    skills = (0, import_node_fs42.existsSync)((0, import_node_path39.join)(root, "skills")) && (0, import_node_fs42.statSync)((0, import_node_path39.join)(root, "skills")).isDirectory();
   } catch {
   }
   return {
-    hostPresent: (0, import_node_fs41.existsSync)(host),
+    hostPresent: (0, import_node_fs42.existsSync)(host),
     installRecordPresent,
     manifest,
-    payloadPresent: (0, import_node_fs41.existsSync)((0, import_node_path37.join)(root, "__init__.py")) && skills && manifest === "valid",
+    payloadPresent: (0, import_node_fs42.existsSync)((0, import_node_path39.join)(root, "__init__.py")) && skills && manifest === "valid",
     ...installedVersion ? { installedVersion } : {}
   };
 }
@@ -37613,7 +37847,7 @@ function installedSurfacePluginVersion(surface) {
   const token = surfaceToken(surface);
   if (token === "kilo") {
     try {
-      const stamp = (0, import_node_fs41.readFileSync)((0, import_node_path37.join)((0, import_node_os18.homedir)(), ".kilo", ".mmi-kilo-version"), "utf8").trim();
+      const stamp = (0, import_node_fs42.readFileSync)((0, import_node_path39.join)((0, import_node_os18.homedir)(), ".kilo", ".mmi-kilo-version"), "utf8").trim();
       return stamp || void 0;
     } catch {
       return void 0;
@@ -37621,13 +37855,13 @@ function installedSurfacePluginVersion(surface) {
   }
   if (token === "hermes") return readHermesPluginEvidence().installedVersion;
   if (token === "cursor") {
-    return manifestVersion((0, import_node_path37.join)(cursorLocalPluginRoot(), ".cursor-plugin", "plugin.json"));
+    return manifestVersion((0, import_node_path39.join)(cursorLocalPluginRoot(), ".cursor-plugin", "plugin.json"));
   }
   if (token === "jervcode") {
     return installedJervCodePackageVersion();
   }
   if (token === "kimi") {
-    return manifestVersion((0, import_node_path37.join)(surfaceConfigRoot(surface), "plugins", "managed", "mmi", ".kimi-plugin", "plugin.json"));
+    return manifestVersion((0, import_node_path39.join)(surfaceConfigRoot(surface), "plugins", "managed", "mmi", ".kimi-plugin", "plugin.json"));
   }
   if (token === "claude") return installedClaudePluginVersion();
   if (token !== "codex") return void 0;
@@ -37661,13 +37895,13 @@ function worktreeRootSync() {
 }
 var gitignorePath = () => {
   const root = worktreeRootSync();
-  return root === null ? null : (0, import_node_path37.join)(root, ".gitignore");
+  return root === null ? null : (0, import_node_path39.join)(root, ".gitignore");
 };
 function readGitignore() {
   const path2 = gitignorePath();
   if (path2 === null) return null;
   try {
-    return (0, import_node_fs41.readFileSync)(path2, "utf8");
+    return (0, import_node_fs42.readFileSync)(path2, "utf8");
   } catch {
     return null;
   }
@@ -37676,14 +37910,14 @@ function writeGitignore(content) {
   const path2 = gitignorePath();
   if (path2 === null) return false;
   try {
-    (0, import_node_fs41.writeFileSync)(path2, content, "utf8");
+    (0, import_node_fs42.writeFileSync)(path2, content, "utf8");
     return true;
   } catch {
     return false;
   }
 }
 function lineEndingState(root) {
-  const attributesPresent = (0, import_node_fs41.existsSync)((0, import_node_path37.join)(root, ".gitattributes"));
+  const attributesPresent = (0, import_node_fs42.existsSync)((0, import_node_path39.join)(root, ".gitattributes"));
   try {
     const output = execFileCapture("git", ["-C", root, "ls-files", "--eol", "--", ":(glob)**/*.sh"], {
       windowsHide: true
@@ -37750,8 +37984,8 @@ ${r.stderr ?? ""}`).catch(() => "");
 function ghMultiAccountCaveat(announcedLogin) {
   try {
     const hostsPath = ghHostsConfigPath(process.env, process.platform);
-    if (!hostsPath || !(0, import_node_fs42.existsSync)(hostsPath)) return void 0;
-    return ghAccountCaveat(announcedLogin, parseGhHostsAccounts((0, import_node_fs42.readFileSync)(hostsPath, "utf8")));
+    if (!hostsPath || !(0, import_node_fs43.existsSync)(hostsPath)) return void 0;
+    return ghAccountCaveat(announcedLogin, parseGhHostsAccounts((0, import_node_fs43.readFileSync)(hostsPath, "utf8")));
   } catch {
     return void 0;
   }
@@ -37759,7 +37993,7 @@ function ghMultiAccountCaveat(announcedLogin) {
 var ENV_HEAL_LOCK_STALE_MS = 10 * 6e4;
 var ENV_HEAL_LOCK_MAX_WAIT_MS = 2 * 6e4;
 function envHealLockPath(home) {
-  return (0, import_node_path38.join)(home, ".claude", "plugins", ".mmi-env-heal.lock");
+  return (0, import_node_path40.join)(home, ".claude", "plugins", ".mmi-env-heal.lock");
 }
 async function withEnvHealLock(what, run) {
   try {
@@ -37896,7 +38130,7 @@ function mmiDoctorDeps(opts = {}) {
       );
       const result = applyPluginCachePlan(
         plan,
-        (p) => (0, import_node_fs42.rmSync)(p, { recursive: true }),
+        (p) => (0, import_node_fs43.rmSync)(p, { recursive: true }),
         stagingApplyFsGuard(configRoot)
       );
       return {
@@ -37934,7 +38168,7 @@ function mmiDoctorDeps(opts = {}) {
     // adopted the generated routing index (MMG-Unlive: `docs/Archive/**` only, no index, no gate.yml) would
     // get a permanent — demanding an artifact it never asked for.
     docsIndexState: (root) => {
-      if (!(0, import_node_fs42.existsSync)((0, import_node_path38.join)(root, DOCS_INDEX_PATH))) return void 0;
+      if (!(0, import_node_fs43.existsSync)((0, import_node_path40.join)(root, DOCS_INDEX_PATH))) return void 0;
       const real = createDocsIndexDeps(root);
       let docs2;
       const listDocs = () => docs2 ??= real.listDocs();
@@ -37943,7 +38177,7 @@ function mmiDoctorDeps(opts = {}) {
     },
     // #4168: working-tree heal — write if drifted, then re-check. Commit remains the operator's step.
     healDocsIndex: (root) => {
-      if (!(0, import_node_fs42.existsSync)((0, import_node_path38.join)(root, DOCS_INDEX_PATH))) return { drift: false, docCount: 0 };
+      if (!(0, import_node_fs43.existsSync)((0, import_node_path40.join)(root, DOCS_INDEX_PATH))) return { drift: false, docCount: 0 };
       const real = createDocsIndexDeps(root);
       let docs2;
       const listDocs = () => docs2 ??= real.listDocs();
@@ -38040,7 +38274,18 @@ async function requireFreshTrainCli(commandName) {
     releasedVersion
   });
   if (report.ok) return;
-  throw new Error(staleTrainCliMessage(report, commandName));
+  if (process.env.MMI_TRAIN_NO_SELF_UPDATE === "1") {
+    throw new Error(staleTrainCliMessage(report, commandName));
+  }
+  const converge = await selfConvergeTrainCli({
+    currentVersion: resolveClientVersion(),
+    releasedVersion: report.releasedVersion,
+    commandName
+  });
+  if (converge.kind === "failed") {
+    throw new Error(`${commandName}: ${converge.error}. ${staleTrainCliMessage(report, commandName)}`);
+  }
+  process.exit(converge.reexecCode);
 }
 var cachedCommandPaths;
 function allCommandPaths() {
@@ -38253,19 +38498,19 @@ program2.hook("preAction", async (_thisCommand, actionCommand) => {
 });
 var rules = program2.command("rules").description("org-managed .gitignore delivery");
 rules.command("gitignore").option("--write", "upsert the managed block into .gitignore (default: check only, non-zero exit on drift)").option("--json", "machine-readable output").description("verify (or --write) this repo's org-managed .gitignore block matches the SSOT").action((opts) => {
-  const path2 = (0, import_node_path38.join)(process.cwd(), ".gitignore");
-  const current = (0, import_node_fs42.existsSync)(path2) ? (0, import_node_fs42.readFileSync)(path2, "utf8") : null;
+  const path2 = (0, import_node_path40.join)(process.cwd(), ".gitignore");
+  const current = (0, import_node_fs43.existsSync)(path2) ? (0, import_node_fs43.readFileSync)(path2, "utf8") : null;
   const plan = planManagedGitignore(current);
   const drift = [...plan.added.map((l) => `+${l}`), ...plan.removed.map((l) => `-${l}`)].join(", ") || "block normalize";
   if (opts.json) {
-    if (opts.write && plan.changed) (0, import_node_fs42.writeFileSync)(path2, plan.content, "utf8");
+    if (opts.write && plan.changed) (0, import_node_fs43.writeFileSync)(path2, plan.content, "utf8");
     console.log(JSON.stringify(plan, null, 2));
     if (!opts.write && plan.changed) process.exitCode = 1;
     return;
   }
   if (opts.write) {
     if (plan.changed) {
-      (0, import_node_fs42.writeFileSync)(path2, plan.content, "utf8");
+      (0, import_node_fs43.writeFileSync)(path2, plan.content, "utf8");
       console.log(`mmi-cli devops org rules gitignore: updated .gitignore (${drift})`);
     } else {
       console.log("mmi-cli devops org rules gitignore: up to date");
@@ -38451,7 +38696,7 @@ function scheduleRelatedDiscovery(o) {
   try {
     const args = ["issue", "discover-related", "--number", String(o.number), "--title", o.title, "--body", o.body, "--fail-soft"];
     if (o.repo) args.push("--repo", o.repo);
-    spawnDetachedSelf(args, { spawn: import_node_child_process17.spawn, execPath: process.execPath, scriptPath: process.argv[1] }, { cwd: process.cwd() });
+    spawnDetachedSelf(args, { spawn: import_node_child_process19.spawn, execPath: process.execPath, scriptPath: process.argv[1] }, { cwd: process.cwd() });
   } catch {
   }
 }
@@ -38841,7 +39086,7 @@ project.command("set [owner/repo]").description("upsert project META (idempotent
   if (dupe) return fail(`org project set: KEY "${dupe}" was passed to both --var and --set; --set is an alias of --var, so pass each KEY once`);
   if (o.secretsFile) {
     try {
-      vars.push(`secrets=${(0, import_node_fs42.readFileSync)(o.secretsFile, "utf8")}`);
+      vars.push(`secrets=${(0, import_node_fs43.readFileSync)(o.secretsFile, "utf8")}`);
     } catch (e) {
       return fail(`org project set: cannot read --secrets-file ${o.secretsFile}: ${e.message}`);
     }
@@ -39666,11 +39911,11 @@ pr.command("view <number>").description("read a PR as structured JSON (merged st
   }
 });
 async function listCiWorkflowPaths(cwd = process.cwd()) {
-  const wfDir = (0, import_node_path38.join)(cwd, ".github", "workflows");
-  if (!(0, import_node_fs42.existsSync)(wfDir)) return [];
-  return (0, import_node_fs42.readdirSync)(wfDir).filter((name) => /\.(ya?ml)$/i.test(name)).filter((name) => {
+  const wfDir = (0, import_node_path40.join)(cwd, ".github", "workflows");
+  if (!(0, import_node_fs43.existsSync)(wfDir)) return [];
+  return (0, import_node_fs43.readdirSync)(wfDir).filter((name) => /\.(ya?ml)$/i.test(name)).filter((name) => {
     try {
-      return workflowReportsPrChecks((0, import_node_fs42.readFileSync)((0, import_node_path38.join)(wfDir, name), "utf8"));
+      return workflowReportsPrChecks((0, import_node_fs43.readFileSync)((0, import_node_path40.join)(wfDir, name), "utf8"));
     } catch {
       return true;
     }
@@ -39736,16 +39981,16 @@ function ciAuditDeps() {
     // gate re-seed step is skipped gracefully rather than failing mid-run.
     readSeedFile: (path2) => {
       if (!root) return null;
-      const fullPath = (0, import_node_path38.join)(root, path2);
-      return (0, import_node_fs42.existsSync)(fullPath) ? (0, import_node_fs42.readFileSync)(fullPath, "utf8") : null;
+      const fullPath = (0, import_node_path40.join)(root, path2);
+      return (0, import_node_fs43.existsSync)(fullPath) ? (0, import_node_fs43.readFileSync)(fullPath, "utf8") : null;
     }
   };
 }
 function hubRoot() {
-  const fromPkg = (0, import_node_path38.join)(__dirname, "..", "..");
+  const fromPkg = (0, import_node_path40.join)(__dirname, "..", "..");
   const marker = "skills/bootstrap/seeds/manifest.json";
-  if ((0, import_node_fs42.existsSync)((0, import_node_path38.join)(fromPkg, marker))) return fromPkg;
-  if ((0, import_node_fs42.existsSync)((0, import_node_path38.join)(process.cwd(), marker))) return process.cwd();
+  if ((0, import_node_fs43.existsSync)((0, import_node_path40.join)(fromPkg, marker))) return fromPkg;
+  if ((0, import_node_fs43.existsSync)((0, import_node_path40.join)(process.cwd(), marker))) return process.cwd();
   return null;
 }
 async function waitLoopCorePool(label) {
@@ -40017,15 +40262,24 @@ pr.command("land <number>").description("agent merge path (#1440): train probe \
   else printLine(`pr land: ${result.status}${result.error ? ` \u2014 ${result.error}` : ""}`);
   if (result.status === "failed") process.exitCode = 1;
 });
-jsonParity(pr.command("merge <number>").description("merge a PR (squash by default); archives gitignored tmp/** before worktree teardown; on no-ci repos run pr ci-policy / checks-wait first (#1432, #5679)").option("--squash", "squash merge (default)").option("--merge", "create a merge commit").option("--rebase", "rebase merge").option("--repo <owner/repo>", "target repo (defaults to the current repo)").option("--auto", "enable auto-merge \u2014 merge once the base-branch policy is satisfied (use for policy-gated repos)").option("--wait", `wait for checks to reach a terminal passing verdict before merging (default budget ${PR_CHECKS_TIMEOUT_MS / 6e4}m)`).option("--preserve-worktree", "after merge, keep the local PR worktree/branch for an active batch (#1888)").option("--gc", "acknowledge deleting unarchived gitignored tmp/** evidence newer than the branch base (#5679)").option("--squash-body-file <path>", "squash commit body (overrides GitHub COMMIT_MESSAGES); use when a pushed commit mentions close/fix/resolve + #N that must not close (#5723)").option("--force", "acknowledge and merge past a remaining prunable/severe scratch housekeeping block (advisory kept plans/ never blocks, #3012) or a negated-closing-keyword (#3718) or ambiguous-cross-repo-closing (#4279) refusal")).action(async (number, o) => {
+jsonParity(pr.command("merge <number>").description("merge a PR (squash by default); archives gitignored tmp/** before worktree teardown; on no-ci repos run pr ci-policy / checks-wait first (#1432, #5679)").option("--squash", "squash merge (default)").option("--merge", "create a merge commit").option("--rebase", "rebase merge").option("--repo <owner/repo>", "target repo (defaults to the current repo)").option("--auto", "enable auto-merge \u2014 merge once the base-branch policy is satisfied (use for policy-gated repos)").addOption(new Option("--disable-auto", "disable a queued auto-merge without merging").conflicts(["auto", "wait", "squash", "merge", "rebase", "preserveWorktree", "gc", "squashBodyFile", "force"])).option("--wait", `wait for checks to reach a terminal passing verdict before merging (default budget ${PR_CHECKS_TIMEOUT_MS / 6e4}m)`).option("--preserve-worktree", "after merge, keep the local PR worktree/branch for an active batch (#1888)").option("--gc", "acknowledge deleting unarchived gitignored tmp/** evidence newer than the branch base (#5679)").option("--squash-body-file <path>", "squash commit body (overrides GitHub COMMIT_MESSAGES); use when a pushed commit mentions close/fix/resolve + #N that must not close (#5723)").option("--force", "acknowledge and merge past a remaining prunable/severe scratch housekeeping block (advisory kept plans/ never blocks, #3012) or a negated-closing-keyword (#3718) or ambiguous-cross-repo-closing (#4279) refusal")).action(async (number, o) => {
   const method = o.rebase ? "--rebase" : o.merge ? "--merge" : "--squash";
   const repoArgs = o.repo ? ["--repo", o.repo] : [];
+  if (o.disableAuto) {
+    await execFileP2("gh", buildPrDisableAutoArgs({ number, repoArgs }), { timeout: GH_MUTATION_TIMEOUT_MS }).catch((e) => {
+      const note = timeoutKillNote(e, GH_MUTATION_TIMEOUT_MS);
+      if (note) throw new Error(`gh pr merge ${number} --disable-auto: ${note}`);
+      throw e;
+    });
+    console.log(JSON.stringify({ mergeStatus: "auto-merge-disabled", pr: number, ...o.repo ? { repo: o.repo } : {} }));
+    return;
+  }
   const repoForPostCleanup = await resolveRepo(o.repo) ?? o.repo;
-  const prMeta = await execFileP2("gh", ["pr", "view", number, ...repoArgs, "--json", "headRefName,baseRefName,headRefOid", "--jq", "{head: .headRefName, base: .baseRefName, oid: .headRefOid}"], { timeout: GC_GH_TIMEOUT_MS }).then((r) => JSON.parse(r.stdout)).catch(async (e) => {
+  const prMeta = await execFileP2("gh", ["pr", "view", number, ...repoArgs, "--json", "headRefName,baseRefName,headRefOid,state", "--jq", "{head: .headRefName, base: .baseRefName, oid: .headRefOid, state: .state}"], { timeout: GC_GH_TIMEOUT_MS }).then((r) => JSON.parse(r.stdout)).catch(async (e) => {
     if (!isGitHubRateLimitError(e) || !repoForPostCleanup) throw e;
     console.warn(`pr merge: gh GraphQL rate-limited \u2014 reading PR #${number} via REST instead (#4588).`);
     const snapshot = await fetchRestPrSnapshot(number, repoForPostCleanup);
-    return { head: snapshot.headRef, base: snapshot.baseRef, oid: snapshot.headSha };
+    return { head: snapshot.headRef, base: snapshot.baseRef, oid: snapshot.headSha, state: snapshot.merged ? "MERGED" : snapshot.state.toUpperCase() };
   });
   const headRef = prMeta.head;
   const baseRef = prMeta.base;
@@ -40046,7 +40300,7 @@ jsonParity(pr.command("merge <number>").description("merge a PR (squash by defau
   const mergeSquashBody = squashBodyTextForMerge(
     closingGuardInput,
     method === "--squash",
-    o.squashBodyFile ? (0, import_node_fs42.readFileSync)(o.squashBodyFile, "utf8") : void 0
+    o.squashBodyFile ? (0, import_node_fs43.readFileSync)(o.squashBodyFile, "utf8") : void 0
   );
   if (!o.squashBodyFile) warnSquashBodyClosingStrip("pr merge", closingGuardInput, mergeSquashBody);
   const closingGuardVerdict = evaluateClosingGuard(closingGuardInput, {
@@ -40060,6 +40314,11 @@ jsonParity(pr.command("merge <number>").description("merge a PR (squash by defau
     return;
   }
   if (closingGuardVerdict.message) console.warn(closingGuardVerdict.message);
+  if (prMeta.state !== "MERGED" && !o.preserveWorktree) {
+    if (!repoForPostCleanup) throw new Error("pr merge: repository is unreadable; cannot prove remote branch preservation");
+    const repoSettings = await defaultGitHubClient().rest("GET", `repos/${repoForPostCleanup}`);
+    assertRemoteBranchPreservedOnMerge(repoForPostCleanup, repoSettings.delete_branch_on_merge);
+  }
   const startingPath = (await execFileP2("git", ["rev-parse", "--show-toplevel"], { timeout: GIT_TIMEOUT_MS }).catch(() => ({ stdout: "" }))).stdout.trim();
   const housekeeping = assertPrMergeHousekeepingClean(startingPath || process.cwd(), "pr merge", { force: o.force });
   const beforeWorktreesRead = await execFileP2("git", ["worktree", "list", "--porcelain"], { timeout: GIT_TIMEOUT_MS }).then((r) => ({ state: "ok", stdout: r.stdout })).catch((e) => ({ state: "failed", error: e.message || "git worktree list failed" }));
@@ -40107,7 +40366,7 @@ jsonParity(pr.command("merge <number>").description("merge a PR (squash by defau
   }
   const remoteBefore = await remoteBranchExists2(headRef);
   let upgradedToAuto = false;
-  let remoteNotAttemptedReason = "host-owned-lifecycle";
+  let remoteNotAttemptedReason = "preserved-delayed-cleanup";
   const overrideBody = mergeSquashBody ? { ...writeSquashBodyFile(mergeSquashBody), text: mergeSquashBody } : await composeOverrideBodyFile(
     number,
     repoArgs,
@@ -40130,7 +40389,7 @@ jsonParity(pr.command("merge <number>").description("merge a PR (squash by defau
         }
         if (!repoForPostCleanup) throw e;
         console.warn(`pr merge: gh GraphQL rate-limited \u2014 merging PR #${number} via REST PUT instead (#4588).`);
-        const commitMessage = bodyFile ? (0, import_node_fs42.readFileSync)(bodyFile, "utf8") : void 0;
+        const commitMessage = bodyFile ? (0, import_node_fs43.readFileSync)(bodyFile, "utf8") : void 0;
         await defaultGitHubClient().rest("PUT", `repos/${repoForPostCleanup}/pulls/${number}/merge`, {
           body: { merge_method: method.slice(2), ...commitMessage ? { commit_message: commitMessage } : {} },
           timeoutMs: GH_MUTATION_TIMEOUT_MS
@@ -40219,7 +40478,7 @@ jsonParity(pr.command("merge <number>").description("merge a PR (squash by defau
       preserveWorktree: o.preserveWorktree,
       gcAcknowledged: o.gc,
       expectedHeadOid: headRefOid,
-      pathExists: (p) => (0, import_node_fs42.existsSync)(p),
+      pathExists: (p) => (0, import_node_fs43.existsSync)(p),
       execGit: async (args) => (await execFileP2("git", args, { timeout: GIT_TIMEOUT_MS })).stdout
     });
   } catch (e) {
@@ -40326,7 +40585,7 @@ function trainApplyDeps() {
     run: async (file, args) => {
       const timeout = file === "node" && args[1] === "prepare" ? NODE_PREPARE_TIMEOUT_MS : file === "node" && args[1] === "verify" ? NODE_VERIFY_TIMEOUT_MS : file === "npm" ? NPM_TRAIN_TIMEOUT_MS : file === "bash" && args[0] === "scripts/jerv-gateway-release-deploy.sh" ? JERV_GATEWAY_DEPLOY_TIMEOUT_MS : file !== "gh" ? GIT_TIMEOUT_MS : args[0] === "run" && args[1] === "watch" ? GH_RUN_WATCH_TIMEOUT_MS : GH_TRAIN_TIMEOUT_MS;
       try {
-        return isWin2 && file === "npm" ? (await execFileP2("cmd.exe", ["/c", "npm", ...args], { timeout })).stdout : (await execFileP2(file, args, { timeout })).stdout;
+        return isWin3 && file === "npm" ? (await execFileP2("cmd.exe", ["/c", "npm", ...args], { timeout })).stdout : (await execFileP2(file, args, { timeout })).stdout;
       } catch (e) {
         throw surfaceTrainSubprocessFailure(e, file, args);
       }
@@ -40422,6 +40681,7 @@ function renderReleaseResume(r) {
   if (r.dispatch) lines.push(`  deploy: ${r.dispatch.note}`);
   if (r.devRollForward) lines.push(`  development: ${r.devRollForward.note}`);
   if (r.rcAlignment) lines.push(`  rc: ${r.rcAlignment.note}`);
+  if (r.checkout) lines.push(`  checkout: ${r.checkout.note}`);
   return lines.join("\n");
 }
 function renderReleaseAbort(r) {
@@ -40506,7 +40766,7 @@ for (const commandName of ["rcand", "release"]) {
     { flags: "--ack <shas>", description: "comma-separated dev shas a human verified are in the candidate, overriding the hotfix-coverage guard for a conflicted port whose -x trailer was lost (#958)" },
     { flags: "--dev", description: "full-track repos release development -> main directly, skipping rc (refuses if rc carries content not in development; no-op on direct-track repos) (#1062)" },
     { flags: "--abort", description: "with --apply, delete only a proven unpublished failed release candidate on any registered deploy model and restore local main for a same-version recut (#3944/#5650/#5657)" },
-    { flags: "--retry-publish <run-id>", description: "with --apply, retry failed jobs of one proven Hub publish release run (#3949)" }
+    { flags: "--retry-publish <run-id>", description: "with --apply, retry one proven failed or cancelled Hub publish release run (#3949/#5797)" }
   ];
   for (const f of RELEASE_ONLY_FLAGS) {
     if (commandName === "release") {
@@ -40762,7 +41022,7 @@ function hotfixStatusDeps() {
     run: async (file, args) => {
       const timeout = file === "npm" ? STATUS_NPM_MS : file === "gh" ? STATUS_GH_MS : STATUS_GIT_MS;
       try {
-        return isWin2 && file === "npm" ? (await execFileP2("cmd.exe", ["/c", "npm", ...args], { timeout })).stdout : (await execFileP2(file, args, { timeout })).stdout;
+        return isWin3 && file === "npm" ? (await execFileP2("cmd.exe", ["/c", "npm", ...args], { timeout })).stdout : (await execFileP2(file, args, { timeout })).stdout;
       } catch (e) {
         throw surfaceTrainSubprocessFailure(e, file, args);
       }
@@ -40805,8 +41065,7 @@ ${r.repo}: applied=[${r.applied.join("; ")}] skipped=[${r.skipped.join("; ")}]${
       console.log("\nDry-run \u2014 re-run with --apply to patch merge settings and activate product rulesets (master-admin).");
     }
   }
-  const applyFailed = applyResults.some((result) => result.errors.length > 0 || result.postApply?.state === "failed");
-  if (!audit.ok || applyFailed) process.exitCode = 1;
+  if (ciReconcileExitFailed({ apply: o.apply === true, audit, applyResults })) process.exitCode = 1;
 });
 registerBootstrapCommands(program2);
 var access = program2.command("access").description("org access audit (read-only)");
@@ -40855,18 +41114,18 @@ access.command("audit").description("audit collaborator roles + train-branch pus
     targets = resolution.targets;
   }
   const derivedMatrix = registryProjects ? accessMatrixFromProjects(registryProjects) : {};
-  const fileMatrix = (0, import_node_fs42.existsSync)("access-matrix.json") ? loadAccessMatrix((0, import_node_fs42.readFileSync)("access-matrix.json", "utf8")) : {};
+  const fileMatrix = (0, import_node_fs43.existsSync)("access-matrix.json") ? loadAccessMatrix((0, import_node_fs43.readFileSync)("access-matrix.json", "utf8")) : {};
   const matrix = mergeAccessMatrix(fileMatrix, derivedMatrix);
   const derivedContracts = registryProjects ? dataAccessContractsFromProjects(registryProjects) : { consumers: {} };
-  const fileContracts = (0, import_node_fs42.existsSync)("data-access-contracts.json") ? loadDataAccessContracts((0, import_node_fs42.readFileSync)("data-access-contracts.json", "utf8")) : { consumers: {} };
+  const fileContracts = (0, import_node_fs43.existsSync)("data-access-contracts.json") ? loadDataAccessContracts((0, import_node_fs43.readFileSync)("data-access-contracts.json", "utf8")) : { consumers: {} };
   const dataAccess = mergeDataAccessContracts(fileContracts, derivedContracts);
-  const sanctioned = (0, import_node_fs42.existsSync)("access-matrix.json") ? loadSanctionedAdmins((0, import_node_fs42.readFileSync)("access-matrix.json", "utf8")) : {};
+  const sanctioned = (0, import_node_fs43.existsSync)("access-matrix.json") ? loadSanctionedAdmins((0, import_node_fs43.readFileSync)("access-matrix.json", "utf8")) : {};
   const report = await auditOrgAccess(targets, deps, matrix, dataAccess, sanctioned);
   console.log(o.json ? JSON.stringify(report, null, 2) : renderAccessReport(report));
   if (!report.ok) process.exitCode = 1;
 });
 access.command("capabilities").description("enumerate your effective vault reach \u2014 every credential NAME + tier + scope you can read/use across project + org/master tiers (names only, no values) (#1615)").option("--repo <owner/repo>", "target repo (defaults to the current repo)").option("--json", "machine-readable output").action((o) => withSecrets((d) => secretsCapabilities(d, o)));
-var isWin2 = process.platform === "win32";
+var isWin3 = process.platform === "win32";
 program2.command("doctor").description("safely heal active plugin wiring and report hygiene; repository cleanup requires explicit --apply (#5023), while version convergence belongs to `mmi-hub update`").option("--banner", "one-line resume summary; silent when all gates pass").option("--fast", "offline-safe fast lane; read-only, skips slow checks and network probes").option("--preflight", "read-only fast gate for automation: measures and reports with the shared exit code, zero writes").option("--verbose", "print the evidence behind every check \u2014 probes, resolved paths, versions compared, and the names behind each count (#2977)").option("--guide", "print the canonical MMI Agentic Onboarding URL").option("--json", "machine-readable output (an output format \u2014 repairs still run by lane)").option("--apply", "advanced explicit lane: also apply guarded repository maintenance (gitignore, docs index, board mechanics, merged branches, aged scratch); the host owns workspace cleanup").option("--no-repo-writes", "compatibility spelling for the safe default: env/plugin repairs only, never mutate the repository").option("--self", "verify CLI/plugin version parity and gh auth reach; suggests plugin-heal on a hard gap (reads the published version, so not offline-safe) (#2689)").addHelpText("after", "\nExit codes:\n  0  no hard gaps remain; advisory gaps may exist\n  1  one or more included hard checks failed\n\nA plain run may heal safe machine-global plugin wiring but never mutates the repository. Run\n`mmi-cli doctor --apply` only when you explicitly want the guarded full repository cleanup lane.\nCLI and host version convergence belongs to `mmi-hub update`; doctor reports lag and last-run evidence.\n--banner/--fast/--self/--preflight are read-only lanes.\n").action(async (opts) => {
   if (opts.guide) {
     consoleIo.log(`MMI Agentic Onboarding: ${CANONICAL_ONBOARDING_URL}`);
@@ -40892,16 +41151,16 @@ function directoryBytes(path2) {
   let total = 0;
   let entries;
   try {
-    entries = (0, import_node_fs42.readdirSync)(path2, { withFileTypes: true });
+    entries = (0, import_node_fs43.readdirSync)(path2, { withFileTypes: true });
   } catch {
     return 0;
   }
   for (const entry of entries) {
-    const child2 = (0, import_node_path38.join)(path2, entry.name);
+    const child2 = (0, import_node_path40.join)(path2, entry.name);
     if (entry.isDirectory()) total += directoryBytes(child2);
     else {
       try {
-        total += (0, import_node_fs42.statSync)(child2).size;
+        total += (0, import_node_fs43.statSync)(child2).size;
       } catch {
       }
     }
@@ -40909,25 +41168,25 @@ function directoryBytes(path2) {
   return total;
 }
 function listDirEntries(dir) {
-  return (0, import_node_fs42.readdirSync)(dir, { withFileTypes: true }).map((d) => ({ name: d.name, isDirectory: d.isDirectory() }));
+  return (0, import_node_fs43.readdirSync)(dir, { withFileTypes: true }).map((d) => ({ name: d.name, isDirectory: d.isDirectory() }));
 }
 function readInstalledPluginRefs(configRoot) {
   const p = installedPluginsPathForConfig(configRoot);
-  if (!(0, import_node_fs42.existsSync)(p)) return [];
+  if (!(0, import_node_fs43.existsSync)(p)) return [];
   try {
-    return installedPluginPaths((0, import_node_fs42.readFileSync)(p, "utf8"));
+    return installedPluginPaths((0, import_node_fs43.readFileSync)(p, "utf8"));
   } catch {
     return null;
   }
 }
 function pluginCacheFsDeps(configRoot, dirBytes) {
   return {
-    exists: (p) => (0, import_node_fs42.existsSync)(p),
-    listVersionDirs: (root) => (0, import_node_fs42.readdirSync)(root, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name),
+    exists: (p) => (0, import_node_fs43.existsSync)(p),
+    listVersionDirs: (root) => (0, import_node_fs43.readdirSync)(root, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name),
     dirBytes,
-    listStagingDirs: (root) => (0, import_node_fs42.readdirSync)(root, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => {
+    listStagingDirs: (root) => (0, import_node_fs43.readdirSync)(root, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => {
       try {
-        return { name: d.name, mtimeMs: newestMtimeMs((0, import_node_path38.join)(root, d.name), listDirEntries, (p) => (0, import_node_fs42.statSync)(p).mtimeMs) };
+        return { name: d.name, mtimeMs: newestMtimeMs((0, import_node_path40.join)(root, d.name), listDirEntries, (p) => (0, import_node_fs43.statSync)(p).mtimeMs) };
       } catch {
         return { name: d.name, mtimeMs: Date.now() };
       }
@@ -40941,10 +41200,10 @@ function stagingApplyFsGuard(configRoot) {
   return {
     referencedPaths: () => readInstalledPluginRefs(configRoot),
     mtimeMs: (name) => {
-      const p = (0, import_node_path38.join)(stagingRoot, name);
-      if (!(0, import_node_fs42.existsSync)(p)) return null;
+      const p = (0, import_node_path40.join)(stagingRoot, name);
+      if (!(0, import_node_fs43.existsSync)(p)) return null;
       try {
-        return newestMtimeMs(p, listDirEntries, (q) => (0, import_node_fs42.statSync)(q).mtimeMs);
+        return newestMtimeMs(p, listDirEntries, (q) => (0, import_node_fs43.statSync)(q).mtimeMs);
       } catch {
         return null;
       }
@@ -40970,7 +41229,7 @@ program2.command("plugin-prune").description(`prune stale cached MMI plugin vers
     { withBytes: true, configRoot, includeStaging: surface !== "codex" }
   );
   const anythingToDelete = plan.prune.length > 0 || plan.staging.length > 0;
-  const result = o.apply && anythingToDelete ? applyPluginCachePlan(plan, (p) => (0, import_node_fs42.rmSync)(p, { recursive: true, force: true }), stagingApplyFsGuard(configRoot)) : void 0;
+  const result = o.apply && anythingToDelete ? applyPluginCachePlan(plan, (p) => (0, import_node_fs43.rmSync)(p, { recursive: true, force: true }), stagingApplyFsGuard(configRoot)) : void 0;
   const warnings = plan.prune.length > 0 ? [CONCURRENT_SESSION_WARNING] : [];
   if (o.json) console.log(JSON.stringify({ ...plan, warnings, applied: result ?? null }));
   else console.log(renderPluginCachePlan(plan, result));