@mutmutco/cli 4.3.0 → 4.3.2

package/dist/main.cjs

@@ -3416,7 +3416,7 @@ function useColor() {
 var program = new Command();
 
 // src/command-composition.ts
-var import_node_fs46 = require("node:fs");
+var import_node_fs48 = require("node:fs");
 
 // src/clean-exit.ts
 var UNDICI_GLOBAL_DISPATCHER_SYMBOL = Object.getOwnPropertySymbols(globalThis).find(
@@ -3465,19 +3465,19 @@ function hardExit(code) {
 }
 var STDIO_FLUSH_TIMEOUT_MS = 2e3;
 function flushStream(stream) {
-  return new Promise((resolve6) => {
+  return new Promise((resolve7) => {
     try {
-      stream.write("", () => resolve6());
+      stream.write("", () => resolve7());
     } catch {
-      resolve6();
+      resolve7();
     }
   });
 }
 async function flushStdio(timeoutMs = STDIO_FLUSH_TIMEOUT_MS) {
   await Promise.race([
     Promise.all([flushStream(process.stdout), flushStream(process.stderr)]),
-    new Promise((resolve6) => {
-      setTimeout(resolve6, timeoutMs).unref?.();
+    new Promise((resolve7) => {
+      setTimeout(resolve7, timeoutMs).unref?.();
     })
   ]);
 }
@@ -3485,7 +3485,7 @@ async function cleanExit(code) {
   process.exitCode = code;
   await closeHttpPool();
   await flushStdio();
-  await new Promise((resolve6) => setImmediate(resolve6));
+  await new Promise((resolve7) => setImmediate(resolve7));
   return void 0;
 }
 var CLI_EXIT_WATCHDOG_MS = (() => {
@@ -3930,7 +3930,7 @@ async function fetchWithRetry(fetchImpl, url, init, opts = {}) {
   const attempts = opts.attempts ?? 3;
   const baseDelayMs = opts.baseDelayMs ?? 250;
   const retryOn = opts.retryOn ?? ((res) => res.status >= 500);
-  const sleep2 = opts.sleep ?? ((ms) => new Promise((resolve6) => setTimeout(resolve6, ms)));
+  const sleep2 = opts.sleep ?? ((ms) => new Promise((resolve7) => setTimeout(resolve7, ms)));
   let lastErr;
   for (let i = 0; i < attempts; i++) {
     const isLast = i === attempts - 1;
@@ -4198,8 +4198,8 @@ async function readStdin(opts = {}) {
   })().catch(() => {
   });
   let timer;
-  const timeout = new Promise((resolve6) => {
-    timer = setTimeout(resolve6, timeoutMs);
+  const timeout = new Promise((resolve7) => {
+    timer = setTimeout(resolve7, timeoutMs);
   });
   try {
     await Promise.race([drain, timeout]);
@@ -4253,12 +4253,12 @@ function killProcessTree(pid) {
 function execFileHard(file, args, options) {
   const { timeout, step, ...rest } = options;
   const started = Date.now();
-  return new Promise((resolve6, reject) => {
+  return new Promise((resolve7, reject) => {
     const child2 = (0, import_node_child_process2.execFile)(file, args, { encoding: "utf8", windowsHide: true, ...rest, timeout: 0 }, (error, stdout, stderr) => {
       clearTimeout(timer);
       if (expired) return;
       if (error) reject(error);
-      else resolve6({ stdout: String(stdout), stderr: String(stderr) });
+      else resolve7({ stdout: String(stdout), stderr: String(stderr) });
     });
     let expired = false;
     const timer = setTimeout(() => {
@@ -5219,8 +5219,8 @@ function unknownCommandDomainGuide(parentPath, token) {
 }
 
 // src/command-composition.ts
-var import_node_os19 = require("node:os");
-var import_node_path43 = require("node:path");
+var import_node_os20 = require("node:os");
+var import_node_path45 = require("node:path");
 
 // src/board-read.ts
 var import_node_fs13 = require("node:fs");
@@ -5330,7 +5330,7 @@ function rateLimitedReceipt(opts) {
   };
 }
 async function runWithRateLimitBackoff(operation, opts) {
-  const sleep2 = opts.sleep ?? ((ms) => new Promise((resolve6) => setTimeout(resolve6, ms)));
+  const sleep2 = opts.sleep ?? ((ms) => new Promise((resolve7) => setTimeout(resolve7, ms)));
   const now = opts.now ?? Date.now;
   const log = opts.log ?? ((message) => console.warn(message));
   const capMs = opts.capMs ?? RATE_LIMIT_WAIT_CAP_MS;
@@ -8016,13 +8016,47 @@ async function defaultCompareRefs(exec, repo, base, head) {
     return "unknown";
   }
 }
+async function publishAbsentPrHeadIfOwned(repo, head, exec) {
+  if (isForkStyleHead(head)) return false;
+  let originRepo;
+  try {
+    const { stdout } = await exec("git", ["remote", "get-url", "--push", "origin"], { timeout: GIT_TIMEOUT_MS });
+    originRepo = repoFromRemoteUrl(stdout.trim());
+  } catch {
+    return false;
+  }
+  if (!originRepo || originRepo.toLowerCase() !== repo.toLowerCase()) return false;
+  let currentBranch2;
+  try {
+    currentBranch2 = (await exec("git", ["symbolic-ref", "--quiet", "--short", "HEAD"], { timeout: GIT_TIMEOUT_MS })).stdout.trim();
+  } catch {
+    return false;
+  }
+  if (!currentBranch2 || currentBranch2 !== head) return false;
+  let commit;
+  try {
+    commit = (await exec("git", ["rev-parse", "--verify", "HEAD^{commit}"], { timeout: GIT_TIMEOUT_MS })).stdout.trim();
+  } catch {
+    return false;
+  }
+  if (!commit) return false;
+  try {
+    await exec("git", ["push", "origin", `${commit}:refs/heads/${head}`], { timeout: GH_MUTATION_TIMEOUT_MS });
+    return true;
+  } catch {
+    return false;
+  }
+}
 async function preflightPrCreateRemoteHead(args, deps) {
   const repo = flagValue(args, "--repo");
   const head = flagValue(args, "--head");
   if (!repo || !head || isForkStyleHead(head)) return void 0;
   const readRemoteHead = deps.readRemoteHead ?? ((input) => defaultReadRemoteHead(deps.exec, input.repo, input.head));
-  const presence = await readRemoteHead({ repo, head });
-  if (presence === "absent") return unpushedHeadMessage(head);
+  let presence = await readRemoteHead({ repo, head });
+  if (presence === "absent") {
+    if (!await publishAbsentPrHeadIfOwned(repo, head, deps.exec)) return unpushedHeadMessage(head);
+    presence = "present";
+  }
   if (presence !== "present") return void 0;
   const base = flagValue(args, "--base");
   if (!base) return void 0;
@@ -8438,7 +8472,7 @@ async function createPrViaRestFallback(args, swappedArgs, deps, knownPools) {
 }
 async function ghCreate(args, deps = {}) {
   const exec = deps.exec ?? execFileP;
-  const sleep2 = deps.sleep ?? ((ms) => new Promise((resolve6) => setTimeout(resolve6, ms)));
+  const sleep2 = deps.sleep ?? ((ms) => new Promise((resolve7) => setTimeout(resolve7, ms)));
   const now = deps.now ?? Date.now;
   const read = deps.readFile ?? import_promises.readFile;
   const restCreatePr = deps.restCreatePr ?? ((input) => defaultRestCreatePr(exec, input));
@@ -9151,8 +9185,8 @@ var PRE_SPAWN_DRAIN_TIMEOUT_MS = 2e3;
 async function drainHttpPoolBeforeSpawn() {
   const drained = await Promise.race([
     closeHttpPool().then(() => true),
-    new Promise((resolve6) => {
-      setTimeout(() => resolve6(false), PRE_SPAWN_DRAIN_TIMEOUT_MS).unref?.();
+    new Promise((resolve7) => {
+      setTimeout(() => resolve7(false), PRE_SPAWN_DRAIN_TIMEOUT_MS).unref?.();
     })
   ]);
   if (!drained) destroyHttpPool();
@@ -9400,8 +9434,22 @@ function repoFromSelector(selector) {
     return void 0;
   }
 }
+var REPO_OPTION_SHAPES = "owner/repo or host/owner/repo";
+function invalidRepoOption(repo, hint) {
+  const base = `invalid repo "${repo}" (expected ${REPO_OPTION_SHAPES})`;
+  return new Error(hint ? `${base} \u2014 ${hint}` : base);
+}
+async function validateRepoOption(repo) {
+  const value = repo.trim();
+  const parts = value.split("/");
+  if ((parts.length === 2 || parts.length === 3) && parts.every((p) => p !== "")) return value;
+  const origin = repoFromRemoteUrl(await gitOut(["remote", "get-url", "origin"])) ?? repoFromRemoteUrl(originUrlFromGitConfig() ?? "");
+  const originName = origin?.split("/")[1];
+  const hint = originName !== void 0 && value.toLowerCase() === originName.toLowerCase() ? `did you mean ${origin}?` : void 0;
+  throw invalidRepoOption(repo, hint);
+}
 async function resolveRepo(repo) {
-  if (repo) return repo;
+  if (repo) return validateRepoOption(repo);
   const fromOrigin = repoFromRemoteUrl(await gitOut(["remote", "get-url", "origin"])) ?? repoFromRemoteUrl(originUrlFromGitConfig() ?? "");
   if (fromOrigin) return fromOrigin;
   try {
@@ -12271,7 +12319,7 @@ async function setBoardItemPriority(client, cfg, itemId, priority) {
   await updateItemSingleSelect(client, cfg.projectId, itemId, cfg.priorityFieldId, optionId);
   return cliPriorityToFieldName(priority);
 }
-var defaultRetrySleep = (ms) => new Promise((resolve6) => setTimeout(resolve6, ms));
+var defaultRetrySleep = (ms) => new Promise((resolve7) => setTimeout(resolve7, ms));
 async function resolveProjectItemIdWithRetry(client, cfg, selector, opts = {}) {
   const attempts = Math.max(1, opts.attempts ?? 5);
   const delayMs = opts.delayMs ?? 300;
@@ -15274,10 +15322,10 @@ var rollout_plan_default = {
     note: "The v4.0.0 stamp happens at cut time (D6e #4463); until then the candidate is the origin/development head artifacts (built cli/dist + npm pack), identity proven by dist content hash (D6a)."
   },
   baseline: {
-    version: "4.3.0",
-    tag: "v4.3.0",
-    commit: "7d0b99dccb42",
-    npm: "@mutmutco/cli@4.3.0"
+    version: "4.3.2",
+    tag: "v4.3.2",
+    commit: "c4aa995c1dfc",
+    npm: "@mutmutco/cli@4.3.2"
   },
   exitCriterion: "fleet-n-of-n",
   hubOnlyShortcut: "forbidden",
@@ -15294,14 +15342,14 @@ var rollout_plan_default = {
           repo: "mutmutco/mmi-hub",
           role: "canary",
           schedule: "train",
-          v3Target: "v4.3.0"
+          v3Target: "v4.3.2"
         }
       ],
       rollbackTrigger: "Any red inside the post-contract soak window: `devops train gate` FAIL attributable to the v4 doors, Hub endpoint health probe failure, a pre-v4 client admitted instead of receiving actionable HTTP 426, or npm consumer install/doctor failure on the v4-only dist.",
       rollback: {
         independent: true,
-        mechanism: "npm dist-tag latest -> 4.3.0 and redeploy the Hub Lambda from tag v4.3.0 (7d0b99dccb42); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
-        v3Target: "v4.3.0 (@mutmutco/cli@4.3.0, tag commit 7d0b99dccb42 \u2014 last known-good release carrying the repo-index v4-only contract)"
+        mechanism: "npm dist-tag latest -> 4.3.2 and redeploy the Hub Lambda from tag v4.3.2 (c4aa995c1dfc); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
+        v3Target: "v4.3.2 (@mutmutco/cli@4.3.2, tag commit c4aa995c1dfc \u2014 last known-good release carrying the repo-index v4-only contract)"
       }
     },
     {
@@ -16169,6 +16217,7 @@ function validateEnum(flag, allowed, value, command) {
 var ISSUE_STATES = ["open", "closed", "all"];
 var PR_STATES = ["open", "all"];
 async function resolveBoardProjectId(repoOption) {
+  if (repoOption !== void 0) await validateRepoOption(repoOption);
   try {
     const floor = await loadConfig();
     if (!floor.sagaApiUrl) return void 0;
@@ -17270,7 +17319,7 @@ async function runMergeTreePreflight(deps, ours, theirs) {
 async function predictMergeConflicts(deps, ours, theirs) {
   return runMergeTreePreflight(deps, ours, theirs);
 }
-async function mergeWithToleratedResolution(deps, sourceRef, label, resolve6, extraTolerated = []) {
+async function mergeWithToleratedResolution(deps, sourceRef, label, resolve7, extraTolerated = []) {
   try {
     await deps.run("git", ["merge", sourceRef, "--no-edit"]);
     return;
@@ -17284,7 +17333,7 @@ async function mergeWithToleratedResolution(deps, sourceRef, label, resolve6, ex
       unmerged.length === 0 ? `${label} merge failed without conflicted paths \u2014 merge aborted; inspect the repo state and rerun` : `${label} merge conflicts on untolerated path(s): ${blocking.join(", ")} \u2014 merge aborted (the train is misaligned; reconcile the branches via an approved alignment PR, then rerun)`
     );
   }
-  await deps.run("git", ["checkout", `--${resolve6}`, "--", ...unmerged]);
+  await deps.run("git", ["checkout", `--${resolve7}`, "--", ...unmerged]);
   await deps.run("git", ["add", "--", ...unmerged]);
   await deps.run("git", ["commit", "--no-edit"]);
 }
@@ -17463,7 +17512,7 @@ var CORRELATE_SKEW_SLACK_MS = 1e4;
 var CORRELATE_PAGE_LIMIT = 50;
 var RUN_CONFIRM_ATTEMPTS = 3;
 var RUN_CONFIRM_DELAY_MS = 1e3;
-var defaultSleep = (ms) => new Promise((resolve6) => setTimeout(resolve6, ms));
+var defaultSleep = (ms) => new Promise((resolve7) => setTimeout(resolve7, ms));
 function resolveSleep(deps) {
   return deps.sleep ?? defaultSleep;
 }
@@ -18292,12 +18341,6 @@ async function discoverShaWorkflowRuns(deps, repo, headSha, seenRunIds) {
   }
   return extra;
 }
-async function deriveHistoricalDeployStatus(deps, ctx, model, releaseSha) {
-  const targets = prodReleaseTargets(model);
-  if (!targets.length) return "pending";
-  const repo = model === "hub-serverless" ? HUB_REPO2 : ctx.repo;
-  return aggregateWorkflowRuns(await listOwnWorkflowRuns(deps, repo, targets, releaseSha));
-}
 async function dispatchDeploy(deps, ctx, stage, ref, model, watch, autoRunSince, autoRunHeadSha, dispatchFailure = "throw", publishDir) {
   if (isCentralDispatchModel(model)) {
     const since = (deps.now ?? Date.now)();
@@ -18592,9 +18635,9 @@ function renderTenantControl(r) {
 }
 
 // src/train-apply-phases.ts
-var import_node_fs19 = require("node:fs");
-var import_promises2 = require("node:fs/promises");
-var import_node_path17 = require("node:path");
+var import_node_fs20 = require("node:fs");
+var import_promises3 = require("node:fs/promises");
+var import_node_path19 = require("node:path");
 
 // src/actions-billing-preflight.ts
 var CANARY_WORKFLOW = "actions-job-start-canary.yml";
@@ -18818,37 +18861,1077 @@ Resume it:  ${resumeCommand}
   );
 }
 
+// src/release-ledger.ts
+var import_node_fs19 = require("node:fs");
+var import_node_path18 = require("node:path");
+var import_node_crypto5 = require("node:crypto");
+
+// src/file-lock.ts
+var import_promises2 = require("node:fs/promises");
+var import_node_path17 = require("node:path");
+var sleep = (ms) => new Promise((resolve7) => setTimeout(resolve7, ms));
+var IMMEDIATE_RETRY_BUDGET = 3;
+var FileLockBusyError = class extends Error {
+  lockPath;
+  constructor(label, lockPath, maxWaitMs) {
+    super(`${label} busy: ${lockPath} held longer than ${maxWaitMs}ms`);
+    this.name = "FileLockBusyError";
+    this.lockPath = lockPath;
+  }
+};
+function resolveFileLockOpts(opts = {}) {
+  return {
+    staleMs: opts.staleMs ?? 3e4,
+    retryMs: opts.retryMs ?? 50,
+    maxWaitMs: opts.maxWaitMs ?? 5e3,
+    label: opts.label ?? "file lock"
+  };
+}
+async function acquireFileLock(lockPath, opts, deadline) {
+  let immediateRetries = 0;
+  for (; ; ) {
+    let handle;
+    try {
+      handle = await (0, import_promises2.open)(lockPath, "wx");
+    } catch (e) {
+      const code = e.code;
+      if (code !== "EEXIST" && code !== "EPERM" && code !== "EBUSY" && code !== "EACCES") throw e;
+      const retryNow = async () => {
+        if (Date.now() >= deadline) throw new FileLockBusyError(opts.label, lockPath, opts.maxWaitMs);
+        if (++immediateRetries > IMMEDIATE_RETRY_BUDGET) await sleep(opts.retryMs);
+      };
+      try {
+        const age = Date.now() - (await (0, import_promises2.stat)(lockPath)).mtimeMs;
+        if (age > opts.staleMs) {
+          try {
+            await (0, import_promises2.unlink)(lockPath);
+            await retryNow();
+            continue;
+          } catch (unlinkError) {
+            if (unlinkError instanceof FileLockBusyError) throw unlinkError;
+            const unlinkCode = unlinkError.code;
+            if (unlinkCode === "ENOENT") {
+              await retryNow();
+              continue;
+            }
+          }
+        }
+      } catch (statError) {
+        if (statError instanceof FileLockBusyError) throw statError;
+        if (statError.code !== "ENOENT") throw statError;
+        await retryNow();
+        continue;
+      }
+      if (Date.now() >= deadline) {
+        throw new FileLockBusyError(opts.label, lockPath, opts.maxWaitMs);
+      }
+      await sleep(opts.retryMs);
+      continue;
+    }
+    const token = `${process.pid}-${Date.now()}-${Math.random().toString(36).slice(2)}`;
+    try {
+      await handle.writeFile(token);
+    } catch (e) {
+      await handle.close().catch(() => void 0);
+      throw e;
+    }
+    return { token, handle };
+  }
+}
+async function fileLockHeldBy(lockPath, token) {
+  try {
+    return await (0, import_promises2.readFile)(lockPath, "utf8") === token;
+  } catch {
+    return false;
+  }
+}
+async function releaseFileLock(lockPath, guard) {
+  await guard.handle.close().catch(() => void 0);
+  if (await fileLockHeldBy(lockPath, guard.token)) {
+    await (0, import_promises2.unlink)(lockPath).catch(() => void 0);
+  }
+}
+async function withFileLock(lockPath, opts, fn) {
+  const resolved = resolveFileLockOpts(opts);
+  await (0, import_promises2.mkdir)((0, import_node_path17.dirname)(lockPath), { recursive: true }).catch(() => void 0);
+  const guard = await acquireFileLock(lockPath, resolved, Date.now() + resolved.maxWaitMs);
+  try {
+    return await fn();
+  } finally {
+    await releaseFileLock(lockPath, guard);
+  }
+}
+
+// src/release-ledger.ts
+var RELEASE_LEDGER_SCHEMA = "mmi-release-ledger/v1";
+var RELEASE_LEDGER_PHASES = [
+  "promotion",
+  "ordinaryCi",
+  "githubRelease",
+  "publish",
+  "deploy",
+  "alignment"
+];
+var PHASE_SET = new Set(RELEASE_LEDGER_PHASES);
+var STATE_SET = /* @__PURE__ */ new Set(["pending", "complete", "failed", "skipped"]);
+var ReleaseLedgerError = class extends Error {
+  kind;
+  constructor(kind, message) {
+    super(message);
+    this.name = "ReleaseLedgerError";
+    this.kind = kind;
+  }
+};
+var SHA_RE = /^[0-9a-f]{40}$/;
+var MAX_TEXT = 500;
+function truncate(text, max) {
+  return text.length <= max ? text : `${text.slice(0, max - 1)}\u2026`;
+}
+function normalizeLedgerAnchors(anchors) {
+  const repo = anchors.repo?.trim();
+  const tag = anchors.tag?.trim();
+  const tagSha = anchors.tagSha?.trim().toLowerCase();
+  if (!repo || !/^[^/]+\/[^/]+$/.test(repo)) {
+    throw new ReleaseLedgerError("invalid-record", `release ledger: invalid repo anchor ${JSON.stringify(anchors.repo ?? "")}`);
+  }
+  if (!tag || !/^v\d+\.\d+\.\d+(-rc\.\d+)?$/.test(tag)) {
+    throw new ReleaseLedgerError("invalid-record", `release ledger: invalid tag anchor ${JSON.stringify(anchors.tag ?? "")}`);
+  }
+  if (!tagSha || !SHA_RE.test(tagSha)) {
+    throw new ReleaseLedgerError("invalid-record", `release ledger: invalid tagSha anchor ${JSON.stringify(anchors.tagSha ?? "")}`);
+  }
+  return { repo, tag, tagSha };
+}
+function emptyPhases() {
+  return Object.fromEntries(RELEASE_LEDGER_PHASES.map((p) => [p, { state: "pending", updatedAt: "never" }]));
+}
+function validatePhaseRecord(phase, raw) {
+  if (typeof raw !== "object" || raw === null || Array.isArray(raw)) {
+    throw new ReleaseLedgerError("invalid-record", `release ledger: phase ${phase} is not an object`);
+  }
+  const rec = raw;
+  const state = rec.state;
+  if (typeof state !== "string" || !STATE_SET.has(state)) {
+    throw new ReleaseLedgerError("invalid-record", `release ledger: phase ${phase} has invalid state ${JSON.stringify(state)}`);
+  }
+  if (rec.sha !== void 0 && (typeof rec.sha !== "string" || !SHA_RE.test(rec.sha))) {
+    throw new ReleaseLedgerError("invalid-record", `release ledger: phase ${phase} has a malformed sha`);
+  }
+  if (rec.runId !== void 0 && (typeof rec.runId !== "number" || !Number.isSafeInteger(rec.runId) || rec.runId <= 0)) {
+    throw new ReleaseLedgerError("invalid-record", `release ledger: phase ${phase} has a malformed runId`);
+  }
+  if (rec.runRepo !== void 0 && (typeof rec.runRepo !== "string" || !/^[\w.-]+\/[\w.-]+$/.test(rec.runRepo))) {
+    throw new ReleaseLedgerError("invalid-record", `release ledger: phase ${phase} has a malformed runRepo`);
+  }
+  if (rec.runProvenance !== void 0 && rec.runProvenance !== "sha" && rec.runProvenance !== "dispatch") {
+    throw new ReleaseLedgerError("invalid-record", `release ledger: phase ${phase} has a malformed runProvenance ${JSON.stringify(rec.runProvenance)}`);
+  }
+  for (const key of ["runUrl", "note", "error", "workflow", "event"]) {
+    if (rec[key] !== void 0 && (typeof rec[key] !== "string" || rec[key].length > MAX_TEXT * 4)) {
+      throw new ReleaseLedgerError("invalid-record", `release ledger: phase ${phase} has a malformed ${key}`);
+    }
+  }
+  if (rec.retries !== void 0 && (typeof rec.retries !== "number" || !Number.isSafeInteger(rec.retries) || rec.retries < 0 || rec.retries > 9)) {
+    throw new ReleaseLedgerError("invalid-record", `release ledger: phase ${phase} has a malformed retries value`);
+  }
+  if (typeof rec.updatedAt !== "string" || !rec.updatedAt) {
+    throw new ReleaseLedgerError("invalid-record", `release ledger: phase ${phase} is missing updatedAt`);
+  }
+  return rec;
+}
+function parseReleaseLedger(raw) {
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch (e) {
+    throw new ReleaseLedgerError("unreadable", `release ledger is not valid JSON (${e instanceof Error ? e.message : String(e)}) \u2014 refusing to resume against unreadable state (#5987)`);
+  }
+  if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+    throw new ReleaseLedgerError("unreadable", "release ledger is not a JSON object");
+  }
+  const obj = parsed;
+  if (obj.schema !== RELEASE_LEDGER_SCHEMA) {
+    throw new ReleaseLedgerError(
+      "unknown-schema",
+      `release ledger schema ${JSON.stringify(obj.schema ?? "(missing)")} is not ${JSON.stringify(RELEASE_LEDGER_SCHEMA)} \u2014 a NEWER ledger this CLI cannot interpret must fail closed; do not delete or hand-edit the file, use a CLI that understands it`
+    );
+  }
+  const repo = obj.repo;
+  const tag = obj.tag;
+  const tagSha = obj.tagSha;
+  if (typeof repo !== "string" || !repo || typeof tag !== "string" || !tag || typeof tagSha !== "string" || !SHA_RE.test(tagSha)) {
+    throw new ReleaseLedgerError("unreadable", `release ledger has malformed identity anchors (repo/tag/tagSha)`);
+  }
+  if (typeof obj.updatedAt !== "string" || !obj.updatedAt) {
+    throw new ReleaseLedgerError("unreadable", "release ledger is missing updatedAt");
+  }
+  const phasesRaw = obj.phases;
+  if (typeof phasesRaw !== "object" || phasesRaw === null || Array.isArray(phasesRaw)) {
+    throw new ReleaseLedgerError("unreadable", "release ledger phases block is not an object");
+  }
+  const phases = { ...emptyPhases() };
+  for (const [phase, rec] of Object.entries(phasesRaw)) {
+    if (!PHASE_SET.has(phase)) continue;
+    phases[phase] = validatePhaseRecord(phase, rec);
+  }
+  return { schema: RELEASE_LEDGER_SCHEMA, repo, tag, tagSha, phases, updatedAt: obj.updatedAt };
+}
+function validateLedgerAnchors(ledger, expected) {
+  const anchors = normalizeAnchorsForCompare(expected);
+  if (ledger.repo.toLowerCase() !== anchors.repo.toLowerCase()) {
+    throw new ReleaseLedgerError(
+      "repo-mismatch",
+      `release ledger belongs to ${ledger.repo}, not ${anchors.repo} \u2014 refusing to mix releases across repos (#5987)`
+    );
+  }
+  if (ledger.tag !== anchors.tag) {
+    throw new ReleaseLedgerError(
+      "tag-mismatch",
+      `release ledger belongs to ${ledger.tag}, not ${anchors.tag} \u2014 refusing to resume a different tag against it (#5987)`
+    );
+  }
+  if (ledger.tagSha.toLowerCase() !== anchors.tagSha.toLowerCase()) {
+    throw new ReleaseLedgerError(
+      "tag-sha-mismatch",
+      `release ledger anchors ${ledger.tag} at ${ledger.tagSha.slice(0, 12)} but live origin reports ${anchors.tagSha.slice(0, 12)} \u2014 the immutable tag moved or the ledger is stale; failing closed instead of trusting either (#5987)`
+    );
+  }
+}
+function normalizeAnchorsForCompare(expected) {
+  const repo = expected.repo?.trim() ?? "";
+  const tag = expected.tag?.trim() ?? "";
+  const tagSha = expected.tagSha?.trim().toLowerCase() ?? "";
+  if (!repo || !tag || !SHA_RE.test(tagSha)) {
+    throw new ReleaseLedgerError("invalid-record", `release ledger: invalid live anchors (repo=${JSON.stringify(repo)}, tag=${JSON.stringify(tag)})`);
+  }
+  return { repo, tag, tagSha };
+}
+function resolvePrimaryGitDir(cwd) {
+  const gitDir = resolveGitDir(cwd);
+  if (!gitDir) {
+    throw new ReleaseLedgerError("no-checkout", `release ledger: no git checkout found above ${cwd}`);
+  }
+  let common;
+  try {
+    common = (0, import_node_fs19.readFileSync)((0, import_node_path18.join)(gitDir, "commondir"), "utf8").trim();
+  } catch (e) {
+    if (e.code !== "ENOENT") {
+      throw new ReleaseLedgerError("unreadable", `release ledger: the worktree gitdir's commondir pointer could not be READ (${e instanceof Error ? e.message : String(e)}) \u2014 a failed read is unverified, not primary (#5987/#4713)`);
+    }
+  }
+  if (!common) return gitDir;
+  const commonDir = (0, import_node_path18.isAbsolute)(common) ? common : (0, import_node_path18.resolve)(gitDir, common);
+  try {
+    (0, import_node_fs19.readFileSync)((0, import_node_path18.join)(commonDir, "HEAD"), "utf8");
+  } catch (e) {
+    throw new ReleaseLedgerError("no-checkout", `release ledger: the worktree's commondir pointer names ${commonDir}, which has no readable HEAD (${e instanceof Error ? e.message : String(e)}) \u2014 the primary checkout may have been removed; refusing to write the ledger into a doomed location`);
+  }
+  return commonDir;
+}
+function releaseLedgerPath(cwd) {
+  return (0, import_node_path18.join)(resolvePrimaryGitDir(cwd), "mmi-runtime", "release", "phases.json");
+}
+function atomicWriteJson(path2, ledger) {
+  (0, import_node_fs19.mkdirSync)((0, import_node_path18.dirname)(path2), { recursive: true });
+  const tmp = `${path2}.tmp-${process.pid}-${(0, import_node_crypto5.randomBytes)(4).toString("hex")}`;
+  (0, import_node_fs19.writeFileSync)(tmp, `${JSON.stringify(ledger, null, 2)}
+`, "utf8");
+  (0, import_node_fs19.renameSync)(tmp, path2);
+}
+async function withReleaseLedger(path2, expected, fn, opts = {}) {
+  return withFileLock(`${path2}.lock`, { label: "release ledger", maxWaitMs: opts.maxWaitMs ?? 5e3 }, async () => {
+    let current;
+    let raw;
+    try {
+      raw = (0, import_node_fs19.readFileSync)(path2, "utf8");
+    } catch (e) {
+      if (e.code !== "ENOENT") {
+        throw new ReleaseLedgerError("unreadable", `release ledger at ${path2} could not be READ (${e instanceof Error ? e.message : String(e)}) \u2014 a failed read is unverified, not absent (#5987)`);
+      }
+    }
+    if (raw !== void 0) {
+      current = parseReleaseLedger(raw);
+      if (expected) validateLedgerAnchors(current, expected);
+    }
+    const { ledger, value } = await fn(current);
+    if (ledger) atomicWriteJson(path2, ledger);
+    return value;
+  });
+}
+function openReleaseLedgerWriter(cwd, opts = {}) {
+  const now = opts.now ?? (() => /* @__PURE__ */ new Date());
+  let path2;
+  try {
+    path2 = releaseLedgerPath(cwd);
+  } catch (e) {
+    const failure = e;
+    return {
+      path: "(unresolved)",
+      record: async () => ({ ok: false, error: failure instanceof Error ? failure.message : String(failure) }),
+      load: async () => {
+        throw failure;
+      }
+    };
+  }
+  return {
+    path: path2,
+    record: async (anchors, phase, entry) => {
+      try {
+        return await withReleaseLedger(
+          path2,
+          anchors,
+          (current) => {
+            const normalized = normalizeLedgerAnchors(anchors);
+            const base = current ?? {
+              schema: RELEASE_LEDGER_SCHEMA,
+              repo: normalized.repo,
+              tag: normalized.tag,
+              tagSha: normalized.tagSha,
+              phases: emptyPhases(),
+              updatedAt: now().toISOString()
+            };
+            const previousRetries = base.phases[phase].retries ?? 0;
+            const record = {
+              ...entry,
+              note: entry.note !== void 0 ? truncate(entry.note, MAX_TEXT) : void 0,
+              error: entry.error !== void 0 ? truncate(entry.error, MAX_TEXT * 2) : void 0,
+              retries: entry.retries ?? previousRetries,
+              updatedAt: now().toISOString()
+            };
+            const updated = {
+              ...base,
+              phases: { ...base.phases, [phase]: record },
+              updatedAt: now().toISOString()
+            };
+            return { ledger: updated, value: { ok: true } };
+          },
+          { maxWaitMs: opts.maxWaitMs }
+        );
+      } catch (e) {
+        return { ok: false, error: e instanceof Error ? e.message : String(e) };
+      }
+    },
+    load: async (anchors) => {
+      try {
+        return await withReleaseLedger(
+          path2,
+          anchors,
+          (current) => ({ value: current }),
+          { maxWaitMs: opts.maxWaitMs }
+        );
+      } catch (e) {
+        if (e instanceof ReleaseLedgerError) throw e;
+        throw new ReleaseLedgerError("unreadable", e instanceof Error ? e.message : String(e));
+      }
+    }
+  };
+}
+function compactEntry(entry) {
+  return Object.fromEntries(Object.entries(entry).filter(([, v]) => v !== void 0));
+}
+function phaseEntry(entry) {
+  return compactEntry(entry);
+}
+var PHASE_RANK = { failed: 0, pending: 1, complete: 2, skipped: 2 };
+function deriveReleasePhaseStatus(ledger) {
+  const legs = RELEASE_LEDGER_PHASES.map((phase) => {
+    const rec = ledger.phases[phase];
+    return {
+      phase,
+      state: rec.state,
+      ...rec.runId !== void 0 ? { runId: rec.runId } : {},
+      ...rec.runRepo !== void 0 ? { runRepo: rec.runRepo } : {},
+      ...rec.workflow !== void 0 ? { workflow: rec.workflow } : {},
+      ...rec.event !== void 0 ? { event: rec.event } : {},
+      ...rec.note !== void 0 ? { note: rec.note } : {},
+      ...rec.error !== void 0 ? { error: rec.error } : {}
+    };
+  });
+  const worst = legs.reduce((acc, leg) => Math.min(acc, PHASE_RANK[leg.state]), 2);
+  return { phaseStatus: worst === 0 ? "phases-failed" : worst === 1 ? "phases-pending" : "phases-green", legs };
+}
+function safeRunAction(runId, runRepo, state) {
+  return state === "failed" ? `next: diagnose with gh run view ${runId} --repo ${runRepo} --log-failed; rerun by hand only when the cause is fixed: gh run rerun ${runId} --repo ${runRepo} --failed (never re-tag)` : `next: gh run watch ${runId} --repo ${runRepo} --exit-status`;
+}
+function formatReleaseLedgerReport(report) {
+  const lines = [`release phase ledger: ${report.phaseStatus.toUpperCase()} (${report.path}) \u2014 phase status of the recorded boundaries, NOT the release verdict`];
+  for (const leg of report.legs) {
+    const detail = leg.error ?? leg.note;
+    const run = [leg.workflow, leg.event ? `(${leg.event})` : void 0, leg.runId != null ? `run ${leg.runId}` : void 0, leg.runRepo ? `in ${leg.runRepo}` : void 0].filter(Boolean).join(" ");
+    lines.push(`  - ${leg.phase}: ${leg.state.toUpperCase()}${run ? ` \u2014 ${run}` : ""}${detail ? ` \u2014 ${detail}` : ""}`);
+    if ((leg.state === "failed" || leg.state === "pending") && leg.runId != null && leg.runRepo) {
+      lines.push(`    ${safeRunAction(leg.runId, leg.runRepo, leg.state === "failed" ? "failed" : "pending")}`);
+    }
+  }
+  return lines;
+}
+function releaseLedgerReport(ledger, path2) {
+  if (!ledger) return void 0;
+  const derived = deriveReleasePhaseStatus(ledger);
+  return { path: path2, phases: ledger.phases, phaseStatus: derived.phaseStatus, legs: derived.legs };
+}
+var TRANSIENT_TRANSPORT_MARKERS = [
+  /connection (?:reset|refused|aborted|timed? ?out)/i,
+  /\bECONN(?:RESET|REFUSED|ABORTED|TIMEDOUT)\b/,
+  /\bE(?:HOST|NET)UNREACH\b/,
+  /\bEAI_AGAIN\b/,
+  /\bEPIPE\b/,
+  /lost communication with (?:the )?github actions runner service/i,
+  /runner lost communication/i,
+  /\b(?:502|503|504)\b[^0-9]{0,40}(?:bad gateway|service unavailable|gateway time-?out|server error)/i,
+  /(?:bad gateway|service unavailable|gateway time-?out)/i,
+  /fetch failed/i,
+  /network (?:error|failure|unreachable|timeout|timed? ?out)/i,
+  /socket hang ?up/i,
+  /remote end hung ?up unexpectedly/i,
+  /early EOF/i,
+  /tls handshake timeout/i
+];
+function classifyTransientTransportFailure(evidence) {
+  if (!evidence) return false;
+  return TRANSIENT_TRANSPORT_MARKERS.some((marker) => marker.test(evidence));
+}
+var TRANSIENT_EVIDENCE_MAX_CHARS = 16e3;
+var AUTO_RERUN_MAX_RETRIES = 1;
+function failedRunIdentity(run, repo) {
+  return `${run.workflow}${run.event ? ` (${run.event})` : ""} run ${run.runId} in ${repo}`;
+}
+function manualRunAction(run, repo) {
+  return `safe next action: diagnose with gh run view ${run.runId} --repo ${repo} --log-failed; rerun by hand only when the cause is fixed: gh run rerun ${run.runId} --repo ${repo} --failed (never re-tag)`;
+}
+async function readFailedRunsOnSha(deps, repo, sha) {
+  try {
+    const rows = JSON.parse(await deps.run("gh", [
+      "run",
+      "list",
+      "--repo",
+      repo,
+      "--commit",
+      sha,
+      "--limit",
+      "20",
+      "--json",
+      "databaseId,url,workflowName,event,status,conclusion"
+    ]));
+    if (!Array.isArray(rows)) return [];
+    return rows.filter((r) => typeof r.databaseId === "number" && r.status === "completed" && (r.conclusion === "failure" || r.conclusion === "cancelled")).map((r) => ({
+      workflow: r.workflowName ?? `run:${r.databaseId}`,
+      runId: r.databaseId,
+      runUrl: r.url,
+      repo,
+      ...r.event ? { event: r.event } : {},
+      conclusion: r.conclusion ?? "failure"
+    }));
+  } catch {
+    return [];
+  }
+}
+async function transientEvidenceForRun(deps, repo, runId) {
+  const parts = [];
+  try {
+    parts.push(await deps.run("gh", ["run", "view", String(runId), "--repo", repo, "--json", "jobs", "--jq", '[.jobs[] | select(.conclusion=="failure") | {name:.name, steps:[.steps[] | select(.conclusion=="failure") | .name]}] | tostring']));
+  } catch {
+  }
+  try {
+    parts.push(await deps.run("gh", ["run", "view", String(runId), "--repo", repo, "--log-failed"]));
+  } catch {
+  }
+  const evidence = parts.filter(Boolean).join("\n");
+  return evidence.length > TRANSIENT_EVIDENCE_MAX_CHARS ? evidence.slice(-TRANSIENT_EVIDENCE_MAX_CHARS) : evidence;
+}
+function extractFailedRequiredContexts(failure) {
+  const match = /required train check failed:\s*([^\n(]+)/.exec(failure);
+  if (!match) return [];
+  return match[1].split(",").map((s) => s.trim()).filter(Boolean);
+}
+async function readFailedCheckRunsOnSha(deps, repo, sha) {
+  try {
+    const rows = JSON.parse(await deps.run("gh", [
+      "api",
+      `repos/${repo}/commits/${sha}/check-runs`,
+      "--jq",
+      '[.check_runs[] | select(.status == "completed" and .conclusion != "success" and .conclusion != null) | {name: .name, url: .details_url}]'
+    ]));
+    if (!Array.isArray(rows)) return [];
+    return rows.flatMap((r) => {
+      if (typeof r.name !== "string" || typeof r.url !== "string") return [];
+      const id = /\/actions\/runs\/(\d+)/.exec(r.url);
+      return [{ name: r.name, ...id ? { runId: Number(id[1]) } : {} }];
+    });
+  } catch {
+    return [];
+  }
+}
+async function correlateCandidateRunsToRequiredContexts(deps, repo, sha, candidates, contexts) {
+  if (contexts.length === 0) {
+    return {
+      unique: false,
+      note: `the failure names no failed required context \u2014 rerunning the first failed run could rerun an unrelated workflow; manual intervention required; safe next action: gh run list --repo ${repo} --commit ${sha.slice(0, 12)} to identify the run`
+    };
+  }
+  const failedChecks = await readFailedCheckRunsOnSha(deps, repo, sha);
+  const contextRunIds = /* @__PURE__ */ new Map();
+  for (const check of failedChecks) {
+    if (check.runId != null && contexts.includes(check.name)) contextRunIds.set(check.runId, check.name);
+  }
+  const proven = candidates.filter((c) => c.runId != null && contextRunIds.has(c.runId));
+  if (proven.length === 1) return { unique: true, candidate: proven[0] };
+  if (proven.length > 1) {
+    return {
+      unique: false,
+      note: `${proven.length} failed runs correspond to the failed required contexts (${contexts.join(", ")}): ${proven.map((c) => failedRunIdentity(c, c.repo ?? repo)).join("; ")} \u2014 ambiguous which to rerun; manual intervention required; safe next action: gh run view <run-id> --repo ${repo} --log-failed`
+    };
+  }
+  return {
+    unique: false,
+    note: `no enumerated failed run corresponds to the failed required contexts (${contexts.join(", ")}) \u2014 the failed run(s) are unrelated to the required gate; manual intervention required; safe next action: gh run view <run-id> --repo ${repo} --log-failed`
+  };
+}
+async function transientRecoveryForFailedPhase(deps, input) {
+  const { ledger, anchors, phase, sha, failure } = input;
+  const enumerated = !input.runs;
+  const provenance = input.runsProvenance ?? "sha";
+  const recordProvenance = provenance === "watched" ? "dispatch" : "sha";
+  let candidates = (input.runs ?? await transientRecoveryEnumerate(deps, input.repo, sha)).filter((r) => typeof r.runId === "number" && (r.conclusion === "failure" || r.conclusion === "cancelled"));
+  const first = candidates[0];
+  await ledger.record(anchors, phase, phaseEntry({
+    state: "failed",
+    sha,
+    error: failure,
+    ...first ? {
+      runId: first.runId,
+      ...first.runUrl ? { runUrl: first.runUrl } : {},
+      runRepo: first.repo ?? input.repo,
+      runProvenance: recordProvenance,
+      workflow: first.workflow,
+      ...first.event ? { event: first.event } : {}
+    } : {}
+  }));
+  const recorded = await ledger.load(anchors).catch(() => void 0);
+  const retriesSoFar = recorded?.phases[phase].retries ?? 0;
+  if (retriesSoFar >= AUTO_RERUN_MAX_RETRIES) {
+    const spent = first ? ` for ${failedRunIdentity(first, first.repo ?? input.repo)}` : "";
+    return {
+      reran: false,
+      recovered: false,
+      ...first?.runId != null ? { runId: first.runId, runRepo: first.repo ?? input.repo } : {},
+      note: `automatic rerun already spent for ${phase}${spent} \u2014 manual intervention required; ${first?.runId != null ? manualRunAction(first, first.repo ?? input.repo) : "safe next action: identify the failed run on the Actions tab"}`
+    };
+  }
+  if (candidates.length === 0) {
+    return { reran: false, recovered: false, note: `no failed run with an id could be classified on ${sha.slice(0, 12)} \u2014 manual intervention required (no marker proof, no automatic rerun); safe next action: gh run list --repo ${input.repo} --commit ${sha.slice(0, 12)} to identify the run` };
+  }
+  if (enumerated && phase === "ordinaryCi") {
+    const correlation = await correlateCandidateRunsToRequiredContexts(deps, input.repo, sha, candidates, extractFailedRequiredContexts(failure));
+    if (!correlation.unique) return { reran: false, recovered: false, note: correlation.note };
+    candidates = [correlation.candidate];
+  }
+  const candidate = candidates[0];
+  const runRepo = candidate.repo ?? input.repo;
+  let meta;
+  try {
+    meta = JSON.parse(await deps.run("gh", [
+      "run",
+      "view",
+      String(candidate.runId),
+      "--repo",
+      runRepo,
+      "--json",
+      "headSha,status,conclusion,url"
+    ]));
+  } catch (e) {
+    return { reran: false, recovered: false, note: `could not READ failed run ${failedRunIdentity(candidate, runRepo)} to prove its identity (${e instanceof Error ? e.message : String(e)}) \u2014 no automatic rerun without proof; ${manualRunAction(candidate, runRepo)}` };
+  }
+  const shaProven = provenance === "watched" || (meta.headSha ?? "").toLowerCase() === sha.toLowerCase();
+  if (!shaProven || meta.conclusion !== "failure") {
+    return { reran: false, recovered: false, note: `run ${failedRunIdentity(candidate, runRepo)} does not prove a failed run on ${sha.slice(0, 12)} \u2014 no automatic rerun; ${manualRunAction(candidate, runRepo)}` };
+  }
+  const evidence = await transientEvidenceForRun(deps, runRepo, candidate.runId);
+  if (!classifyTransientTransportFailure(evidence)) {
+    return { reran: false, recovered: false, note: `run ${failedRunIdentity(candidate, runRepo)} failed on evidence that is NOT a proven transient transport/network failure \u2014 manual intervention required; ${manualRunAction(candidate, runRepo)}` };
+  }
+  const reservation = await ledger.record(anchors, phase, phaseEntry({
+    state: "pending",
+    sha,
+    runId: candidate.runId,
+    ...meta.url ?? candidate.runUrl ? { runUrl: meta.url ?? candidate.runUrl } : {},
+    runRepo,
+    runProvenance: recordProvenance,
+    workflow: candidate.workflow,
+    ...candidate.event ? { event: candidate.event } : {},
+    note: "ONE automatic transient rerun RESERVED (cap spent durably) \u2014 dispatch pending",
+    retries: retriesSoFar + 1
+  }));
+  if (!reservation.ok) {
+    return { reran: false, recovered: false, note: `the rerun reservation could not be durably recorded (${reservation.error}) \u2014 no automatic rerun without a durable cap; manual intervention required; ${manualRunAction(candidate, runRepo)}` };
+  }
+  try {
+    await deps.run("gh", ["run", "rerun", String(candidate.runId), "--repo", runRepo, "--failed"]);
+  } catch (e) {
+    await ledger.record(anchors, phase, phaseEntry({
+      state: "failed",
+      sha,
+      runId: candidate.runId,
+      ...meta.url ?? candidate.runUrl ? { runUrl: meta.url ?? candidate.runUrl } : {},
+      runRepo,
+      runProvenance: recordProvenance,
+      workflow: candidate.workflow,
+      ...candidate.event ? { event: candidate.event } : {},
+      error: `automatic rerun dispatch failed: ${e instanceof Error ? e.message : String(e)}`,
+      retries: retriesSoFar + 1
+    }));
+    return {
+      reran: true,
+      recovered: false,
+      runId: candidate.runId,
+      runRepo,
+      note: `automatic rerun of ${failedRunIdentity(candidate, runRepo)} FAILED to dispatch (${e instanceof Error ? e.message : String(e)}) \u2014 the one automatic rerun remains spent; manual intervention required; ${manualRunAction(candidate, runRepo)}`
+    };
+  }
+  const watched = await (input.watchRun ?? defaultWatchRun)(deps, candidate.runId, runRepo);
+  const runFields = {
+    sha,
+    runId: candidate.runId,
+    ...meta.url ?? candidate.runUrl ? { runUrl: meta.url ?? candidate.runUrl } : {},
+    runRepo,
+    runProvenance: recordProvenance,
+    workflow: candidate.workflow,
+    ...candidate.event ? { event: candidate.event } : {}
+  };
+  if (watched === "success") {
+    await ledger.record(anchors, phase, phaseEntry({
+      state: "complete",
+      ...runFields,
+      note: `recovered: the ONE automatic rerun was watched green in this invocation`,
+      retries: retriesSoFar + 1
+    }));
+    return {
+      reran: true,
+      recovered: true,
+      runId: candidate.runId,
+      runRepo,
+      note: `${failedRunIdentity(candidate, runRepo)} was a proven transient transport failure \u2014 the ONE automatic rerun was dispatched and watched GREEN; continuing in this invocation`
+    };
+  }
+  if (watched === "failure") {
+    await ledger.record(anchors, phase, phaseEntry({
+      state: "failed",
+      ...runFields,
+      error: "the automatic rerun was watched FAILURE \u2014 not transient after all",
+      retries: retriesSoFar + 1
+    }));
+    return {
+      reran: true,
+      recovered: false,
+      runId: candidate.runId,
+      runRepo,
+      note: `the automatic rerun of ${failedRunIdentity(candidate, runRepo)} FAILED \u2014 the one automatic rerun is spent; manual intervention required; ${manualRunAction(candidate, runRepo)}`
+    };
+  }
+  return {
+    reran: true,
+    recovered: false,
+    runId: candidate.runId,
+    runRepo,
+    note: `the automatic rerun of ${failedRunIdentity(candidate, runRepo)} did not resolve within the bounded watch \u2014 typed PENDING (the one automatic rerun is spent); safe next action: gh run watch ${candidate.runId} --repo ${runRepo} --exit-status`
+  };
+}
+async function transientRecoveryEnumerate(deps, repo, sha) {
+  return readFailedRunsOnSha(deps, repo, sha);
+}
+var RUN_CONFIRM_ATTEMPTS2 = 3;
+var RUN_CONFIRM_DELAY_MS2 = 1e3;
+async function defaultWatchRun(deps, runId, repo) {
+  let watchSaidSuccess = true;
+  try {
+    await deps.run("gh", ["run", "watch", String(runId), "--repo", repo, "--exit-status"]);
+  } catch {
+    watchSaidSuccess = false;
+  }
+  let confirmError;
+  for (let attempt = 0; attempt < RUN_CONFIRM_ATTEMPTS2; attempt++) {
+    if (attempt > 0) await new Promise((resolve7) => setTimeout(resolve7, RUN_CONFIRM_DELAY_MS2));
+    try {
+      const parsed = JSON.parse(await deps.run("gh", ["run", "view", String(runId), "--repo", repo, "--json", "status,conclusion"]));
+      if (parsed.status === "completed") return parsed.conclusion === "success" ? "success" : "failure";
+      confirmError = void 0;
+    } catch (e) {
+      confirmError = e;
+    }
+  }
+  if (!watchSaidSuccess) return "failure";
+  if (confirmError) return "pending";
+  return "success";
+}
+function alignmentPhaseEntry(dev, rc) {
+  if (!dev && !rc) return { state: "skipped", note: "no protected-branch alignment leg on this release" };
+  const pending = dev?.status === "pr-pending" || rc?.status === "pr-pending";
+  const note = [dev ? `development: ${dev.note}` : void 0, rc ? `rc: ${rc.note}` : void 0].filter(Boolean).join("; ");
+  return { state: pending ? "pending" : "complete", note };
+}
+function runRowState(run, fallback) {
+  if (!run) return fallback === "success" ? "complete" : fallback === "failure" ? "failed" : "pending";
+  return run.conclusion === "success" ? "complete" : run.conclusion === "failure" ? "failed" : "pending";
+}
+function runMetadata(run, runRepo, provenance) {
+  return {
+    ...run.runId != null ? { runId: run.runId } : {},
+    ...run.runUrl != null ? { runUrl: run.runUrl } : {},
+    ...run.runId != null ? { runRepo, runProvenance: provenance } : {},
+    ...run.workflow ? { workflow: run.workflow } : {},
+    ...run.event ? { event: run.event } : {}
+  };
+}
+function releaseRunRepoFor(model, productRepo) {
+  return model === "hub-serverless" || isCentralDispatchModel(model) ? HUB_REPO2 : productRepo;
+}
+function deployPhaseInput(model, dispatch, opts = {}) {
+  const sha = opts.releaseSha;
+  const runRepo = releaseRunRepoFor(model, "");
+  switch (model) {
+    case "hub-serverless": {
+      const deployRun = (dispatch.workflowRuns ?? []).find((r) => r.workflow === "deploy.yml");
+      return {
+        state: runRowState(deployRun, dispatch.deployStatus),
+        ...sha ? { sha } : {},
+        ...runMetadata(deployRun ?? {}, runRepo, "sha"),
+        note: deployRun ? `${deployRun.workflow} release run` : dispatch.note
+      };
+    }
+    case "registry-publish":
+      return { state: "skipped", ...sha ? { sha } : {}, note: "registry-publish deploys by publishing \u2014 the release-event publish.yml run is the deploy plane" };
+    case "tenant-container":
+    case "solo-container":
+    case "static-cdn":
+      return {
+        state: dispatch.deployStatus === "success" ? "complete" : dispatch.deployStatus === "failure" ? "failed" : "pending",
+        ...sha ? { sha } : {},
+        ...runMetadata({ runId: dispatch.runId, runUrl: dispatch.runUrl, workflow: "tenant-deploy.yml", event: "workflow_dispatch" }, runRepo, "dispatch"),
+        note: dispatch.note
+      };
+    default:
+      return {
+        state: dispatch.deployStatus === "success" ? "complete" : dispatch.deployStatus === "failure" ? "failed" : "pending",
+        ...sha ? { sha } : {},
+        note: dispatch.note
+      };
+  }
+}
+function publishPhaseInput(model, dispatch, publishDispatch, publishRequired, opts = {}) {
+  const sha = opts.releaseSha;
+  const publishRow = publishDispatch ? {
+    state: publishDispatch.deployStatus === "success" ? "complete" : publishDispatch.deployStatus === "failure" ? "failed" : "pending",
+    ...runMetadata({ runId: publishDispatch.runId, runUrl: publishDispatch.runUrl, workflow: "tenant-publish.yml", event: "workflow_dispatch" }, HUB_REPO2, "dispatch"),
+    note: publishDispatch.note
+  } : void 0;
+  switch (model) {
+    case "hub-serverless": {
+      const publishRun = (dispatch.workflowRuns ?? []).find((r) => r.workflow === "publish.yml");
+      return publishRow ?? {
+        state: runRowState(publishRun, dispatch.deployStatus),
+        ...sha ? { sha } : {},
+        ...runMetadata(publishRun ?? {}, HUB_REPO2, "sha"),
+        note: publishRun ? `${publishRun.workflow} release run` : dispatch.note
+      };
+    }
+    case "registry-publish": {
+      const publishRun = (dispatch.workflowRuns ?? []).find((r) => r.workflow === "publish.yml");
+      return publishRow ?? {
+        state: runRowState(publishRun, dispatch.deployStatus),
+        ...sha ? { sha } : {},
+        ...runMetadata(publishRun ?? {}, opts.repo ?? "", "sha"),
+        note: publishRun ? `${publishRun.workflow} release run` : dispatch.note
+      };
+    }
+    case "tenant-container":
+    case "solo-container":
+    case "static-cdn":
+      return publishRow ?? (publishRequired ? { state: "skipped", ...sha ? { sha } : {}, note: opts.skipPublishNote ?? "publish skipped \u2014 deploy not confirmed" } : { state: "skipped", ...sha ? { sha } : {}, note: "publishRequired=false \u2014 no publish leg" });
+    default:
+      return { state: "skipped", ...sha ? { sha } : {}, note: `${model} has no publish leg` };
+  }
+}
+function phaseInputsFromRunRows(model, rows, tagSha, opts = {}) {
+  const deployRun = rows.find((r) => r.workflow === "deploy.yml");
+  const publishRun = rows.find((r) => r.workflow === "publish.yml");
+  switch (model) {
+    case "hub-serverless":
+      return {
+        deploy: {
+          state: runRowState(deployRun, "pending"),
+          sha: tagSha,
+          ...runMetadata(deployRun ?? {}, HUB_REPO2, "sha"),
+          note: deployRun ? `${deployRun.workflow} run on the release SHA` : "deploy.yml release run not yet correlated"
+        },
+        publish: publishRun ? {
+          state: runRowState(publishRun, "pending"),
+          sha: tagSha,
+          ...runMetadata(publishRun, HUB_REPO2, "sha"),
+          note: `${publishRun.workflow} run on the release SHA`
+        } : { state: "pending", sha: tagSha, note: "publish.yml release run not yet correlated" }
+      };
+    case "registry-publish":
+      return {
+        deploy: { state: "skipped", sha: tagSha, note: "registry-publish deploys by publishing \u2014 the release-event publish.yml run is the deploy plane" },
+        publish: publishRun ? {
+          state: runRowState(publishRun, "pending"),
+          sha: tagSha,
+          ...runMetadata(publishRun, opts.repo ?? "", "sha"),
+          note: `${publishRun.workflow} run on the release SHA`
+        } : { state: "pending", sha: tagSha, note: "publish.yml release run not yet correlated" }
+      };
+    default:
+      return {
+        deploy: { state: "pending", sha: tagSha, note: `${model} deploys outside the release SHA's run set \u2014 historical outcome uncorrelatable` },
+        publish: { state: "skipped", sha: tagSha, note: "no historical publish leg correlated for this model" }
+      };
+  }
+}
+async function reverifyPersistedRunPhases(deps, path2, anchors, input) {
+  const now = input.now ?? (() => /* @__PURE__ */ new Date());
+  const notes = [];
+  const result = await withReleaseLedger(
+    path2,
+    anchors,
+    async (current) => {
+      if (!current) return { value: { ledger: void 0, notes } };
+      const phases = { ...current.phases };
+      for (const phase of ["deploy", "publish"]) {
+        const rec = phases[phase];
+        if (rec.updatedAt === "never") continue;
+        if (rec.runId == null) {
+          if (rec.state === "complete") notes.push(`${phase}: persisted complete without a run id \u2014 the live deploy/publish re-derivation below decides the leg`);
+          continue;
+        }
+        if (rec.runProvenance !== "sha" && rec.runProvenance !== "dispatch") {
+          throw new ReleaseLedgerError(
+            "invalid-record",
+            `the persisted ${phase} boundary names run ${rec.runId} without valid runProvenance ('sha'|'dispatch' required, got ${JSON.stringify(rec.runProvenance ?? null)}) \u2014 a run-backed boundary without provenance cannot be re-verified; failing closed (#5987)`
+          );
+        }
+        const runRepo = rec.runRepo ?? input.repo;
+        let meta;
+        try {
+          meta = JSON.parse(await deps.run("gh", [
+            "run",
+            "view",
+            String(rec.runId),
+            "--repo",
+            runRepo,
+            "--json",
+            "status,conclusion,headSha,url"
+          ]));
+        } catch (e) {
+          throw new ReleaseLedgerError(
+            "unreadable",
+            `resume could not re-verify the persisted ${phase} boundary (run ${rec.runId} in ${runRepo}: ${e instanceof Error ? e.message : String(e)}) \u2014 a failed live read is unverified, not passable; retry when GitHub answers (#5987/#4713)`
+          );
+        }
+        if (rec.runProvenance === "sha" && (meta.headSha ?? "").toLowerCase() !== input.sha.toLowerCase()) {
+          throw new ReleaseLedgerError(
+            "tag-sha-mismatch",
+            `the persisted ${phase} boundary names run ${rec.runId} at ${(meta.headSha ?? "").slice(0, 12)} but the release tag is ${input.sha.slice(0, 12)} \u2014 ledger contradicted by live proof; failing closed (#5987)`
+          );
+        }
+        const liveLabel = `${rec.workflow ? `${rec.workflow}${rec.event ? ` (${rec.event})` : ""} ` : ""}run ${rec.runId} in ${runRepo}`;
+        if (meta.status !== "completed") {
+          phases[phase] = { ...rec, state: "pending", note: `re-verified live: ${liveLabel} still in flight`, updatedAt: now().toISOString() };
+          notes.push(`${phase}: ${liveLabel} still in flight \u2014 leg re-verified as pending`);
+          continue;
+        }
+        if (meta.conclusion === "success") {
+          if (rec.state !== "complete") {
+            phases[phase] = { ...rec, state: "complete", note: `re-verified live: ${liveLabel} concluded success`, updatedAt: now().toISOString() };
+            notes.push(`${phase}: ${liveLabel} re-verified green live`);
+          }
+          continue;
+        }
+        if (rec.state === "complete") {
+          throw new ReleaseLedgerError(
+            "contradicted",
+            `the persisted ${phase} boundary says COMPLETE but live ${liveLabel} concluded ${meta.conclusion ?? "not-success"} \u2014 ledger contradicted by live GitHub proof; failing closed instead of trusting either (#5987)`
+          );
+        }
+        phases[phase] = { ...rec, state: "failed", error: `live re-verification: ${liveLabel} concluded ${meta.conclusion}`, updatedAt: now().toISOString() };
+        notes.push(`${phase}: ${liveLabel} failed live \u2014 leg re-verified as failed`);
+      }
+      const ledger = { ...current, phases, updatedAt: now().toISOString() };
+      return { ledger, value: { ledger, notes } };
+    }
+  );
+  return result;
+}
+async function clearLedgerFile(path2, anchors, maxWaitMs) {
+  return withFileLock(`${path2}.lock`, { label: "release ledger", maxWaitMs }, async () => {
+    let raw;
+    try {
+      raw = (0, import_node_fs19.readFileSync)(path2, "utf8");
+    } catch (e) {
+      if (e.code === "ENOENT") return { cleared: false };
+      return { cleared: false, note: `release ledger at ${path2} could not be read for clearing (${e instanceof Error ? e.message : String(e)}) \u2014 left in place` };
+    }
+    let ledger;
+    try {
+      ledger = parseReleaseLedger(raw);
+    } catch (e) {
+      return { cleared: false, note: `release ledger at ${path2} is unreadable (${e instanceof Error ? e.message : String(e)}) \u2014 left in place; inspect it by hand` };
+    }
+    try {
+      validateLedgerAnchors(ledger, anchors);
+    } catch (e) {
+      return { cleared: false, note: `release ledger at ${path2} belongs to ${ledger.tag} @ ${ledger.tagSha.slice(0, 12)} \u2014 not this release; left in place (${e instanceof Error ? e.message : String(e)})` };
+    }
+    (0, import_node_fs19.unlinkSync)(path2);
+    return { cleared: true, note: `cleared the release ledger at ${path2} for the live-proven aborted ${anchors.tag}` };
+  });
+}
+async function clearReleaseLedger(cwd, anchors, opts = {}) {
+  let path2;
+  try {
+    path2 = releaseLedgerPath(cwd);
+  } catch {
+    return void 0;
+  }
+  return (await clearLedgerFile(path2, anchors, opts.maxWaitMs)).note;
+}
+async function reconcileLedgerAfterFailedTagPush(deps, ledger, anchors) {
+  let remoteOut;
+  try {
+    remoteOut = await deps.run("git", ["ls-remote", "origin", `refs/tags/${anchors.tag}`]);
+  } catch (e) {
+    return {
+      action: "kept-unproven",
+      note: `the tag-existence read for ${anchors.tag} FAILED (${e instanceof Error ? e.message : String(e)}) \u2014 the just-started all-pending ledger is LEFT in place (never cleared on a failed read); it will block the next release until this release is resolved by hand (#5987)`
+    };
+  }
+  const remoteSha = remoteOut.trim().split(/\s+/)[0] ?? "";
+  if (remoteSha.toLowerCase() === anchors.tagSha.toLowerCase()) {
+    return {
+      action: "kept-present",
+      note: `origin shows ${anchors.tag} at this release SHA ${remoteSha.slice(0, 12)} \u2014 the partial release state stands and the ledger is kept; resume with mmi-cli devops release --resume (do not re-tag) (#5987)`
+    };
+  }
+  let clear;
+  try {
+    clear = await clearLedgerFile(ledger.path, anchors);
+  } catch (e) {
+    clear = { cleared: false, note: `clear failed: ${e instanceof Error ? e.message : String(e)}` };
+  }
+  if (!clear.cleared && clear.note) {
+    return { action: "kept-unproven", note: `the just-started ledger could not be cleared after origin proved this run has no resumable tag (${clear.note}) \u2014 resolve it by hand (#5987)` };
+  }
+  return {
+    action: "cleared",
+    note: remoteSha ? `origin shows ${anchors.tag} at foreign SHA ${remoteSha.slice(0, 12)}, not this run's ${anchors.tagSha.slice(0, 12)} \u2014 this run's just-started ledger was cleared; let the owning release finish before retrying (#5987)` : `origin proves ${anchors.tag} was never pushed (no tag on origin) \u2014 the just-started all-pending ledger was cleared, so the next release is not blocked; rerun the release once the failure above is fixed (#5987)`
+  };
+}
+async function startReleaseLedger(ledger, anchors, opts = {}) {
+  const now = opts.now ?? (() => /* @__PURE__ */ new Date());
+  try {
+    return await withReleaseLedger(
+      ledger.path,
+      anchors,
+      (current) => {
+        if (current) return { value: { ok: true } };
+        const normalized = normalizeLedgerAnchors(anchors);
+        const fresh = {
+          schema: RELEASE_LEDGER_SCHEMA,
+          repo: normalized.repo,
+          tag: normalized.tag,
+          tagSha: normalized.tagSha,
+          phases: emptyPhases(),
+          updatedAt: now().toISOString()
+        };
+        return { ledger: fresh, value: { ok: true } };
+      }
+    );
+  } catch (e) {
+    return { ok: false, error: e instanceof Error ? e.message : String(e) };
+  }
+}
+async function beginReleaseLedger(deps, cwd, targetTag) {
+  let path2;
+  try {
+    path2 = releaseLedgerPath(cwd);
+  } catch {
+    return { ok: true };
+  }
+  return withFileLock(`${path2}.lock`, { label: "release ledger" }, async () => {
+    let raw;
+    try {
+      raw = (0, import_node_fs19.readFileSync)(path2, "utf8");
+    } catch (e) {
+      if (e.code === "ENOENT") return { ok: true };
+      return { ok: false, error: `the release ledger at ${path2} could not be READ (${e instanceof Error ? e.message : String(e)}) \u2014 a failed read is unverified, not absent (#5987/#4713)` };
+    }
+    let prior;
+    try {
+      prior = parseReleaseLedger(raw);
+    } catch (e) {
+      return { ok: false, error: `the active release ledger at ${path2} is unreadable (${e instanceof Error ? e.message : String(e)}) \u2014 resolve it by hand before starting a release (#5987)` };
+    }
+    if (targetTag && prior.tag === targetTag) return { ok: true };
+    const derived = deriveReleasePhaseStatus(prior);
+    if (derived.phaseStatus !== "phases-green") {
+      const open2 = derived.legs.filter((l) => l.state === "pending" || l.state === "failed");
+      return {
+        ok: false,
+        error: `a prior release ledger for ${prior.tag} is ${derived.phaseStatus} (${open2.map((l) => `${l.phase}=${l.state}`).join(", ")}) \u2014 a new release must not stack on an unresolved one. Finish it first: mmi-cli devops release --resume (or, only when proven unpublished, mmi-cli devops release --abort --apply) (#5987)`
+      };
+    }
+    let liveSha = "";
+    try {
+      liveSha = (await deps.run("git", ["ls-remote", "origin", `refs/tags/${prior.tag}`])).trim().split(/\s+/)[0] ?? "";
+    } catch (e) {
+      return { ok: false, error: `could not prove the completed ${prior.tag} live (${e instanceof Error ? e.message : String(e)}) \u2014 refusing to archive the ledger; retry when origin answers (#5987/#4713)` };
+    }
+    if (liveSha.toLowerCase() !== prior.tagSha.toLowerCase()) {
+      return { ok: false, error: `the completed ${prior.tag} ledger says phases-green but origin reports ${liveSha.slice(0, 12) || "no tag"} \u2260 ${prior.tagSha.slice(0, 12)} \u2014 refusing to archive on unproven state; resolve by hand (#5987)` };
+    }
+    const archivePath = (0, import_node_path18.join)((0, import_node_path18.dirname)(path2), `phases.archive-${prior.tag}.json`);
+    try {
+      (0, import_node_fs19.unlinkSync)(archivePath);
+    } catch (e) {
+      if (e.code !== "ENOENT") {
+        return { ok: false, error: `could not clear the stale archive at ${archivePath} (${e instanceof Error ? e.message : String(e)}) \u2014 the ledger for ${prior.tag} stays active (#5987)` };
+      }
+    }
+    (0, import_node_fs19.renameSync)(path2, archivePath);
+    return { ok: true, note: `archived the completed release ledger ${prior.tag} to ${archivePath} (live-proven at ${prior.tagSha.slice(0, 12)})` };
+  });
+}
+
 // src/train-apply-phases.ts
 var TRAIN_BUMP_INTENTS = ["major", "minor", "patch"];
 function readLocalGateWorkflows() {
-  const dir = (0, import_node_path17.join)(".github", "workflows");
+  const dir = (0, import_node_path19.join)(".github", "workflows");
   let names;
   try {
-    names = (0, import_node_fs19.readdirSync)(dir);
+    names = (0, import_node_fs20.readdirSync)(dir);
   } catch {
     return null;
   }
   const files = [];
   for (const name of names.filter(isGateWorkflowPath)) {
     try {
-      files.push({ path: `${dir}/${name}`.replace(/\\/g, "/"), body: (0, import_node_fs19.readFileSync)((0, import_node_path17.join)(dir, name), "utf8") });
+      files.push({ path: `${dir}/${name}`.replace(/\\/g, "/"), body: (0, import_node_fs20.readFileSync)((0, import_node_path19.join)(dir, name), "utf8") });
     } catch {
     }
   }
   return files;
 }
 function readLocalWorkflows() {
-  const dir = (0, import_node_path17.join)(".github", "workflows");
+  const dir = (0, import_node_path19.join)(".github", "workflows");
   let names;
   try {
-    names = (0, import_node_fs19.readdirSync)(dir);
+    names = (0, import_node_fs20.readdirSync)(dir);
   } catch {
     return null;
   }
   const files = [];
   for (const name of names.filter((n) => /\.ya?ml$/i.test(n))) {
     try {
-      files.push({ path: `${dir}/${name}`.replace(/\\/g, "/"), body: (0, import_node_fs19.readFileSync)((0, import_node_path17.join)(dir, name), "utf8") });
+      files.push({ path: `${dir}/${name}`.replace(/\\/g, "/"), body: (0, import_node_fs20.readFileSync)((0, import_node_path19.join)(dir, name), "utf8") });
     } catch {
     }
   }
@@ -18986,7 +20069,7 @@ async function waitForFoldIndexLock(deps, startBranch, resumeCommand) {
   const deadline = now() + GIT_INDEX_LOCK_WAIT_MS;
   for (; ; ) {
     try {
-      await (0, import_promises2.stat)(lockPath);
+      await (0, import_promises3.stat)(lockPath);
     } catch (e) {
       if (e.code === "ENOENT") return;
       throw foldFailureGuidance(
@@ -19316,8 +20399,35 @@ async function gateTrueMergeCommit(deps, ctx, tag, releaseSha, requiredChecks) {
     }
   }
 }
-async function completeMainRelease(deps, ctx, meta, deployModel, watch, options, tag, releaseSha, startBranch, preFold, tagProbe, branchHints) {
+async function recordPhase(ledger, deps, anchors, phase, entry, opts = {}) {
+  if (!ledger) return;
+  const res = await ledger.record(anchors, phase, entry);
+  if (!res.ok) {
+    const message = `release ledger write FAILED for phase '${phase}' (${res.error}) - already landed and immutable: ${opts.landed ?? "no boundary recorded yet"}. Nothing is rolled back, but this run stops here rather than mutating untracked: resolve the ledger at the recorded path and rerun mmi-cli devops release --resume (#5987)`;
+    if (opts.strict !== false) throw new Error(message);
+    deps.warn?.(message);
+  }
+}
+async function recoverPhaseWithMaybeTransientRerun(deps, ledger, anchors, phase, input) {
+  if (!ledger) return { reran: false, recovered: false, note: "" };
+  try {
+    return await transientRecoveryForFailedPhase(deps, {
+      ledger,
+      anchors,
+      phase,
+      repo: input.repo,
+      sha: input.sha,
+      failure: input.failure,
+      ...input.runs ? { runs: input.runs } : {},
+      runsProvenance: input.watched ? "watched" : "sha"
+    });
+  } catch (e) {
+    return { reran: false, recovered: false, note: `release ledger: the transient recovery read failed (${e instanceof Error ? e.message : String(e)}) - manual intervention required` };
+  }
+}
+async function completeMainRelease(deps, ctx, meta, deployModel, watch, options, tag, releaseSha, startBranch, preFold, tagProbe, branchHints, ledger) {
   const resumeCommand = options.dev ? "mmi-cli devops release --dev --apply" : "mmi-cli devops release --apply";
+  const ledgerAnchors = { repo: ctx.repo, tag, tagSha: releaseSha };
   try {
     await verifyPublishDryRun(deps, ctx, meta, deployModel);
   } catch (e) {
@@ -19344,45 +20454,128 @@ async function completeMainRelease(deps, ctx, meta, deployModel, watch, options,
     }
   }
   let tagPush;
+  let tagLedgerStarted = false;
+  const recoveryInput = { repo: ctx.repo, tag, stage: "main", deployModel, meta, branchHints };
   try {
     await assertComputedReleaseTagStillNext(deps, tag);
     if (deployModel === "hub-serverless") {
       await deps.run("node", ["scripts/release-distribution.mjs", "assert-release-lineage", tag.replace(/^v/, ""), "--release-commit", releaseSha]);
     }
+    if (ledger) {
+      const start = await startReleaseLedger(ledger, ledgerAnchors);
+      if (!start.ok) {
+        throw new Error(
+          `release refused before the tag was pushed: the durable phase ledger could not be started at ${ledger.path} (${start.error}) - nothing was tagged or pushed; repair the ledger location and rerun the release (#5987)`
+        );
+      }
+      tagLedgerStarted = true;
+    }
     tagPush = await ensureTagPushed(deps, tag, releaseSha, tagProbe, ctx.repo);
   } catch (e) {
+    if (ledger && tagLedgerStarted) {
+      const decision = await reconcileLedgerAfterFailedTagPush(deps, ledger, ledgerAnchors);
+      const annotated = new Error(`${e instanceof Error ? e.message : String(e)}
+
+${decision.note}`);
+      if (decision.action === "kept-present") throw partialTrainRecoveryError(annotated, recoveryInput);
+      if (decision.action === "kept-unproven") throw annotated;
+      throw await recoverFailedFold(deps, annotated, startBranch, preFold.mainSha, resumeCommand);
+    }
     throw await recoverFailedFold(deps, e, startBranch, preFold.mainSha, resumeCommand);
   }
   const tagPushSince = (deps.now ?? Date.now)();
   let checks;
-  const recoveryInput = { repo: ctx.repo, tag, stage: "main", deployModel, meta, branchHints };
   try {
     checks = await waitForRequiredTrainChecks(deps, ctx, releaseSha, requiredChecks, tagPush.pushed ? tagPushSince : void 0);
   } catch (e) {
-    throw partialTrainRecoveryError(e, recoveryInput);
+    const failureText = e instanceof Error ? e.message : String(e);
+    const recovery = await recoverPhaseWithMaybeTransientRerun(deps, ledger, ledgerAnchors, "ordinaryCi", {
+      repo: ctx.repo,
+      sha: releaseSha,
+      failure: failureText,
+      watched: false
+    });
+    if (recovery.reran && recovery.recovered) {
+      try {
+        checks = await waitForRequiredTrainChecks(deps, ctx, releaseSha, requiredChecks, void 0);
+      } catch (e2) {
+        const spent = await recoverPhaseWithMaybeTransientRerun(deps, ledger, ledgerAnchors, "ordinaryCi", {
+          repo: ctx.repo,
+          sha: releaseSha,
+          failure: e2 instanceof Error ? e2.message : String(e2),
+          watched: false
+        });
+        throw partialTrainRecoveryError(new Error(`${e2 instanceof Error ? e2.message : String(e2)}
+
+${spent.note}`), recoveryInput);
+      }
+    } else {
+      throw partialTrainRecoveryError(new Error(`${failureText}
+
+${recovery.note}`), recoveryInput);
+    }
   }
+  await recordPhase(ledger, deps, ledgerAnchors, "ordinaryCi", phaseEntry({ state: "complete", sha: releaseSha, note: checks }), {
+    landed: "the immutable tag pushed at " + releaseSha.slice(0, 12)
+  });
   if (trueMergeGateNote) checks = `${trueMergeGateNote}; ${checks}`;
   try {
     await runGitPush(deps, ["push", "origin", "main"]);
   } catch (e) {
+    await recordPhase(ledger, deps, ledgerAnchors, "promotion", phaseEntry({ state: "failed", sha: releaseSha, error: `origin/main push failed after ${tag} was pushed: ${e instanceof Error ? e.message : String(e)}` }), { landed: "the immutable tag pushed at " + releaseSha.slice(0, 12) });
     throw partialTrainRecoveryError(e, recoveryInput);
   }
+  await recordPhase(ledger, deps, ledgerAnchors, "promotion", phaseEntry({ state: "complete", sha: releaseSha, note: `immutable ${tag} pushed at ${releaseSha.slice(0, 12)}; origin/main fast-forwarded to it` }), { landed: "the immutable tag and the green required-check wall" });
   const releaseUrl = clean2(await deps.run("gh", ["release", "create", tag, "--target", "main", "--generate-notes", "--latest", "--repo", ctx.repo])) || void 0;
   await verifyPublishedRelease(deps, ctx.repo, tag, "main", releaseSha);
+  await recordPhase(ledger, deps, ledgerAnchors, "githubRelease", phaseEntry({ state: "complete", sha: releaseSha, runUrl: releaseUrl, note: `verified GitHub Release ${tag} against ${releaseSha.slice(0, 12)}` }), { landed: "the immutable tag, the green required-check wall, and the origin/main fast-forward" });
   const announceNote = deps.announce ? (await deps.announce({ repo: ctx.repo, tag, summaryFile: options.announceSummaryFile })).note : void 0;
   const autoRunSince = (deps.now ?? Date.now)();
-  const deployDispatch = await dispatchDeploy(deps, ctx, "main", "main", deployModel, watch, autoRunSince, releaseSha, "report", meta.publishDir);
+  const deployDispatch0 = await dispatchDeploy(deps, ctx, "main", "main", deployModel, watch, autoRunSince, releaseSha, "report", meta.publishDir);
+  let deployDispatch = deployDispatch0;
+  let deployRecoveryNote;
+  if (deployDispatch0.deployStatus === "failure" && ledger) {
+    const deployRunRepo = releaseRunRepoFor(deployModel, ctx.repo);
+    const failedRow = (deployDispatch0.workflowRuns ?? []).find((r) => r.runId != null && r.conclusion === "failure");
+    const dispatchRun = deployDispatch0.runId != null ? [{ workflow: isCentralDispatchModel(deployModel) ? "tenant-deploy.yml" : "deploy workflow", runId: deployDispatch0.runId, runUrl: deployDispatch0.runUrl, conclusion: "failure", repo: deployRunRepo, ...isCentralDispatchModel(deployModel) ? { event: "workflow_dispatch" } : {} }] : [];
+    const recovery = await recoverPhaseWithMaybeTransientRerun(deps, ledger, ledgerAnchors, failedRow?.workflow === "publish.yml" ? "publish" : "deploy", {
+      repo: deployRunRepo,
+      sha: releaseSha,
+      failure: `watched deploy run(s) failed on the release SHA: ${deployDispatch0.note}`,
+      runs: deployDispatch0.workflowRuns?.filter((r) => r.runId != null).map((r) => ({ ...r, repo: deployRunRepo })) ?? (deployDispatch0.runId != null ? [{ workflow: isCentralDispatchModel(deployModel) ? "tenant-deploy.yml" : "deploy workflow", runId: deployDispatch0.runId, runUrl: deployDispatch0.runUrl, conclusion: "failure", repo: deployRunRepo, ...isCentralDispatchModel(deployModel) ? { event: "workflow_dispatch" } : {} }] : []),
+      watched: isCentralDispatchModel(deployModel)
+    });
+    if (recovery.reran && recovery.recovered) {
+      deployDispatch = {
+        ...deployDispatch0,
+        deployStatus: "success",
+        workflowRuns: deployDispatch0.workflowRuns?.map((r) => recovery.runId != null && r.runId === recovery.runId ? { ...r, conclusion: "success" } : r),
+        note: `${deployDispatch0.note}; ${recovery.note}`
+      };
+    } else if (recovery.note) {
+      deployRecoveryNote = recovery.note;
+    }
+  }
+  await recordPhase(ledger, deps, ledgerAnchors, "deploy", phaseEntry(deployPhaseInput(deployModel, deployDispatch, { releaseSha })), {
+    landed: "the immutable tag, the green required-check wall, the origin/main fast-forward, and the verified GitHub Release"
+  });
   const publishDispatch = deployDispatch.deployStatus === "success" ? await dispatchPublishIfRequired(deps, ctx, meta, deployModel, "main", tag, watch, "report") : null;
-  let dispatch = appendPublishDispatch(deployDispatch, publishDispatch);
-  dispatch = await appendJervGatewayReleaseDeploy(deps, ctx.repo, tag, releaseSha, dispatch);
+  let publishSkipNote;
   if (!publishDispatch && deployDispatch.deployStatus !== "success" && meta.publishRequired && (deployModel === "tenant-container" || deployModel === "solo-container")) {
-    const reason = deployDispatch.deployStatus === "failure" ? "box deploy failed \u2014 redeploy the box before publishing" : "box deploy not confirmed (run with --watch) \u2014 publish after the box deploy lands";
-    dispatch = {
-      ...dispatch,
-      note: `${dispatch.note}; tenant-publish.yml skipped (${reason})`
-    };
+    publishSkipNote = deployDispatch.deployStatus === "failure" ? "box deploy failed - redeploy the box before publishing" : "box deploy not confirmed (run with --watch) - publish after the box deploy lands";
   }
-  return { checks, releaseUrl, announceNote, dispatch };
+  await recordPhase(ledger, deps, ledgerAnchors, "publish", phaseEntry(publishPhaseInput(deployModel, deployDispatch, publishDispatch, meta.publishRequired === true, {
+    releaseSha,
+    repo: ctx.repo,
+    ...publishSkipNote !== void 0 ? { skipPublishNote: publishSkipNote } : {}
+  })), {
+    landed: "the immutable tag, the green required-check wall, origin/main, the verified GitHub Release, and the dispatched deploy path"
+  });
+  let dispatch = appendPublishDispatch(deployDispatch, publishDispatch);
+  dispatch = await appendJervGatewayReleaseDeploy(deps, ctx.repo, tag, releaseSha, dispatch);
+  if (publishSkipNote) dispatch = { ...dispatch, note: `${dispatch.note}; tenant-publish.yml skipped (${publishSkipNote})` };
+  if (deployRecoveryNote) dispatch = { ...dispatch, note: `${dispatch.note}; ${deployRecoveryNote}` };
+  return { checks, releaseUrl, announceNote, dispatch, ledgerAnchors };
 }
 function trainResumeExitCode(state) {
   if (state === "failed") return 1;
@@ -19492,6 +20685,35 @@ async function runReleaseResumePipeline(deps, options, prepared) {
     );
   }
   const base = { command: "release-resume", repo: ctx.repo, tag, tagSha, deployModel };
+  const ledger = openReleaseLedgerWriter(process.cwd());
+  const anchors = { repo: ctx.repo, tag, tagSha };
+  const begin = await beginReleaseLedger(deps, process.cwd(), tag);
+  if (!begin.ok) throw new Error(`release --resume refused: ${begin.error}`);
+  else if (begin.note) deps.warn?.(`release ledger: ${begin.note}`);
+  let persisted;
+  try {
+    persisted = await ledger.load(anchors);
+  } catch (e) {
+    throw new Error(
+      `release --resume: ${e instanceof Error ? e.message : String(e)}
+Live origin/tag/Release proof stays authoritative; nothing was written. Inspect ${ledger.path} before retrying.`
+    );
+  }
+  if (persisted) {
+    let reverifyNotes = [];
+    try {
+      const reverified = await reverifyPersistedRunPhases(deps, ledger.path, anchors, { sha: tagSha, repo: ctx.repo });
+      persisted = reverified.ledger;
+      reverifyNotes = reverified.notes;
+    } catch (e) {
+      throw new Error(
+        `release --resume: ${e instanceof Error ? e.message : String(e)}
+Nothing was written. Inspect ${ledger.path} (or clear it only after proving the release state by hand).`
+      );
+    }
+    for (const note of reverifyNotes) deps.warn?.(`release ledger: ${note}`);
+  }
+  const ledgerMode = persisted ? "strict" : "migration";
   const partialRelease = await isStrayUnreleasedTag(deps, tag, tagSha, ctx.repo);
   if (!partialRelease) {
     try {
@@ -19506,12 +20728,44 @@ async function runReleaseResumePipeline(deps, options, prepared) {
     steps2.push(`development alignment: ${devRollForward2.status}`);
     const rcAlignment2 = !directTrack && branchHints.hasRcBranch ? await alignRcForward(deps, ctx, tag) : void 0;
     if (rcAlignment2) steps2.push(`rc alignment: ${rcAlignment2.status}`);
-    const historicalDeploy = await deriveHistoricalDeployStatus(deps, ctx, deployModel, tagSha);
+    const historicalTargets = prodReleaseTargets(deployModel);
+    const historicalRepo = releaseRunRepoFor(deployModel, ctx.repo);
+    let historicalRows = historicalTargets.length ? await listOwnWorkflowRuns(deps, historicalRepo, historicalTargets, tagSha) : [];
+    let historicalDeploy = historicalTargets.length ? aggregateWorkflowRuns(historicalRows) : "pending";
+    let historicalNote = `historical ${deployModel} deploy/publish status: ${historicalDeploy}`;
+    if (historicalDeploy === "failure" && ledger) {
+      const failedRow = historicalRows.find((r) => r.runId != null && r.conclusion === "failure");
+      const recovery = await recoverPhaseWithMaybeTransientRerun(deps, ledger, anchors, failedRow?.workflow === "publish.yml" ? "publish" : "deploy", {
+        repo: historicalRepo,
+        sha: tagSha,
+        failure: `historical deploy/publish run(s) failed on the release SHA: ${historicalRows.map((r) => `${r.workflow}=${r.conclusion}`).join(", ")}`,
+        runs: historicalRows.filter((r) => r.runId != null).map((r) => ({ ...r, repo: historicalRepo })),
+        watched: false
+      });
+      if (recovery.reran && recovery.recovered) {
+        historicalRows = historicalRows.map((r) => recovery.runId != null && r.runId === recovery.runId ? { ...r, conclusion: "success" } : r);
+        historicalDeploy = aggregateWorkflowRuns(historicalRows);
+        historicalNote = `historical ${deployModel} deploy/publish status: ${historicalDeploy}; ${recovery.note}`;
+      } else if (recovery.note) {
+        historicalNote = `${historicalNote}; ${recovery.note}`;
+      }
+    }
+    if (persisted) {
+      const phaseInputs = phaseInputsFromRunRows(deployModel, historicalRows, tagSha, { repo: ctx.repo });
+      await recordPhase(ledger, deps, anchors, "deploy", phaseEntry(phaseInputs.deploy), { strict: true, landed: "the verified GitHub Release and origin/main at the immutable tag SHA" });
+      await recordPhase(ledger, deps, anchors, "publish", phaseEntry(phaseInputs.publish), { strict: true, landed: "the verified GitHub Release and origin/main at the immutable tag SHA" });
+      await recordPhase(ledger, deps, anchors, "githubRelease", phaseEntry({ state: "complete", sha: tagSha, note: "re-verified live: the GitHub Release exists at the immutable tag SHA" }), { strict: true, landed: "the promotion (verified live)" });
+      await recordPhase(ledger, deps, anchors, "promotion", phaseEntry({ state: "complete", sha: tagSha, note: "re-verified live: origin/main contains the immutable tag SHA" }), { strict: true, landed: "nothing beyond the already-public release" });
+    }
     const dispatch2 = await appendJervGatewayReleaseDeploy(deps, ctx.repo, tag, tagSha, {
-      note: `historical ${deployModel} deploy/publish status: ${historicalDeploy}`,
+      note: historicalNote,
       deployStatus: historicalDeploy
     });
     if (isJervHubRepo(ctx.repo)) steps2.push(dispatch2.note);
+    if (persisted) {
+      await recordPhase(ledger, deps, anchors, "alignment", phaseEntry(alignmentPhaseEntry(devRollForward2, rcAlignment2)), { strict: true, landed: "the released, verified, deploy-resolved release (alignment PRs reused/landed)" });
+    }
+    const ledgerReport2 = releaseLedgerReport(await ledger.load(anchors).catch(() => void 0), ledger.path);
     const state2 = resumeStateOf(deriveTrainFollowUpStatus({
       projectInfo: "ok",
       deploy: deployFollowUpOutcome(dispatch2.deployStatus),
@@ -19528,6 +20782,7 @@ async function runReleaseResumePipeline(deps, options, prepared) {
       devRollForward: devRollForward2,
       rcAlignment: rcAlignment2,
       dispatch: dispatch2,
+      ...ledgerReport2 ? { ledger: ledgerReport2 } : {},
       note: state2 === "failed" ? `release ${tag} was already published, but its deploy/publish on the release SHA FAILED \u2014 re-run the failed job (do NOT re-tag); the protected alignment PRs were reused` : state2 === "pending" ? `release ${tag} was already published; reused its protected alignment PRs, but a deploy/publish or alignment follow-up is unresolved \u2014 watch it to completion` : `release ${tag} was already published; alignment is complete and the deploy on the release SHA is proven green`
     };
   }
@@ -19548,21 +20803,81 @@ async function runReleaseResumePipeline(deps, options, prepared) {
   try {
     steps.push(await waitForRequiredTrainChecks(deps, ctx, tagSha, requiredChecks, void 0));
   } catch (e) {
-    throw partialTrainRecoveryError(e, recoveryInput);
+    const failureText = e instanceof Error ? e.message : String(e);
+    const recovery = await recoverPhaseWithMaybeTransientRerun(deps, ledger, anchors, "ordinaryCi", {
+      repo: ctx.repo,
+      sha: tagSha,
+      failure: failureText,
+      watched: false
+    });
+    if (recovery.reran && recovery.recovered) {
+      try {
+        steps.push(await waitForRequiredTrainChecks(deps, ctx, tagSha, requiredChecks, void 0));
+      } catch (e2) {
+        const spent = await recoverPhaseWithMaybeTransientRerun(deps, ledger, anchors, "ordinaryCi", {
+          repo: ctx.repo,
+          sha: tagSha,
+          failure: e2 instanceof Error ? e2.message : String(e2),
+          watched: false
+        });
+        throw partialTrainRecoveryError(new Error(`${e2 instanceof Error ? e2.message : String(e2)}
+
+${spent.note}`), recoveryInput);
+      }
+    } else {
+      throw partialTrainRecoveryError(new Error(`${failureText}
+
+${recovery.note}`), recoveryInput);
+    }
   }
+  await recordPhase(ledger, deps, anchors, "ordinaryCi", phaseEntry({ state: "complete", sha: tagSha, note: "re-verified the required-check wall live on this resume" }), { strict: ledgerMode === "strict", landed: "the immutable tag on origin at the resumed SHA" });
   await runGitPush(deps, ["push", "origin", `${tagSha}:refs/heads/main`]);
   steps.push(`pushed ${tagSha.slice(0, 12)} to origin/main`);
+  await recordPhase(ledger, deps, anchors, "promotion", phaseEntry({ state: "complete", sha: tagSha, note: `resumed: ${tagSha.slice(0, 12)} pushed to origin/main (tag preserved, never re-cut)` }), { strict: ledgerMode === "strict", landed: "the immutable tag and the re-proven required-check wall" });
   const releaseUrl = clean2(await deps.run("gh", ["release", "create", tag, "--target", "main", "--generate-notes", "--latest", "--repo", ctx.repo])) || void 0;
   steps.push(`created the GitHub Release for ${tag}`);
   await verifyPublishedRelease(deps, ctx.repo, tag, "main", tagSha);
   steps.push("verified the Release published against the tagged commit");
+  await recordPhase(ledger, deps, anchors, "githubRelease", phaseEntry({ state: "complete", sha: tagSha, runUrl: releaseUrl, note: "verified the Release published against the tagged commit" }), { strict: ledgerMode === "strict", landed: "the immutable tag, the re-proven wall, and the origin/main push" });
   const announceNote = deps.announce ? (await deps.announce({ repo: ctx.repo, tag, summaryFile: options.announceSummaryFile })).note : void 0;
   const autoRunSince = (deps.now ?? Date.now)();
-  const deployDispatch = await dispatchDeploy(deps, ctx, "main", "main", deployModel, watch, autoRunSince, tagSha, "report", meta.publishDir);
+  const deployDispatch0 = await dispatchDeploy(deps, ctx, "main", "main", deployModel, watch, autoRunSince, tagSha, "report", meta.publishDir);
+  let deployDispatch = deployDispatch0;
+  let deployRecoveryNote;
+  if (deployDispatch0.deployStatus === "failure" && ledger) {
+    const deployRunRepo = releaseRunRepoFor(deployModel, ctx.repo);
+    const failedRow = (deployDispatch0.workflowRuns ?? []).find((r) => r.runId != null && r.conclusion === "failure");
+    const recovery = await recoverPhaseWithMaybeTransientRerun(deps, ledger, anchors, failedRow?.workflow === "publish.yml" ? "publish" : "deploy", {
+      repo: deployRunRepo,
+      sha: tagSha,
+      failure: `watched deploy run(s) failed on the release SHA: ${deployDispatch0.note}`,
+      runs: deployDispatch0.workflowRuns?.filter((r) => r.runId != null).map((r) => ({ ...r, repo: deployRunRepo })) ?? (deployDispatch0.runId != null ? [{ workflow: isCentralDispatchModel(deployModel) ? "tenant-deploy.yml" : "deploy workflow", runId: deployDispatch0.runId, runUrl: deployDispatch0.runUrl, conclusion: "failure", repo: deployRunRepo, ...isCentralDispatchModel(deployModel) ? { event: "workflow_dispatch" } : {} }] : []),
+      watched: isCentralDispatchModel(deployModel)
+    });
+    if (recovery.reran && recovery.recovered) {
+      deployDispatch = {
+        ...deployDispatch0,
+        deployStatus: "success",
+        workflowRuns: deployDispatch0.workflowRuns?.map((r) => recovery.runId != null && r.runId === recovery.runId ? { ...r, conclusion: "success" } : r),
+        note: `${deployDispatch0.note}; ${recovery.note}`
+      };
+    } else if (recovery.note) {
+      deployRecoveryNote = recovery.note;
+    }
+  }
+  steps.push(`dispatched the ${deployModel} deploy path`);
+  await recordPhase(ledger, deps, anchors, "deploy", phaseEntry(deployPhaseInput(deployModel, deployDispatch, { releaseSha: tagSha })), {
+    strict: ledgerMode === "strict",
+    landed: "the immutable tag, the re-proven wall, the origin/main push, and the verified GitHub Release"
+  });
   const publishDispatch = deployDispatch.deployStatus === "success" ? await dispatchPublishIfRequired(deps, ctx, meta, deployModel, "main", tag, watch, "report") : null;
+  await recordPhase(ledger, deps, anchors, "publish", phaseEntry(publishPhaseInput(deployModel, deployDispatch, publishDispatch, meta.publishRequired === true, { releaseSha: tagSha, repo: ctx.repo })), {
+    strict: ledgerMode === "strict",
+    landed: "the immutable tag, the re-proven wall, origin/main, the verified GitHub Release, and the dispatched deploy path"
+  });
   let dispatch = appendPublishDispatch(deployDispatch, publishDispatch);
   dispatch = await appendJervGatewayReleaseDeploy(deps, ctx.repo, tag, tagSha, dispatch);
-  steps.push(`dispatched the ${deployModel} deploy path`);
+  if (deployRecoveryNote) dispatch = { ...dispatch, note: `${dispatch.note}; ${deployRecoveryNote}` };
   const devRollForward = await rollDevelopmentForward(deps, ctx, tag);
   steps.push(`development roll-forward: ${devRollForward.status}`);
   const rcAlignment = !directTrack && branchHints.hasRcBranch ? await alignRcForward(deps, ctx, tag) : void 0;
@@ -19575,6 +20890,8 @@ async function runReleaseResumePipeline(deps, options, prepared) {
     foldPort: "ok"
   });
   const state = resumeStateOf(followUp);
+  await recordPhase(ledger, deps, anchors, "alignment", phaseEntry(alignmentPhaseEntry(devRollForward, rcAlignment)), { strict: ledgerMode === "strict", landed: "the promotion, verified Release, and deploy path of the resumed release" });
+  const ledgerReport = releaseLedgerReport(await ledger.load(anchors).catch(() => void 0), ledger?.path ?? "(no ledger)");
   return {
     ...base,
     mode: "partial-release",
@@ -19586,6 +20903,7 @@ async function runReleaseResumePipeline(deps, options, prepared) {
     dispatch,
     devRollForward,
     rcAlignment,
+    ...ledgerReport ? { ledger: ledgerReport } : {},
     note: followUp === "failed" ? `resumed ${tag} (version preserved, not re-cut) \u2014 but a watched deploy/publish run FAILED; the Release stands, re-run the failed job (do NOT re-tag)` : followUp === "pending" ? `resumed ${tag} (version preserved, not re-cut) \u2014 a deploy/publish or alignment follow-up is unresolved; watch it to completion` : `resumed and completed ${tag} \u2014 the original version was preserved, not re-cut`
   };
 }
@@ -19679,13 +20997,14 @@ async function runReleaseAbort(deps, options = {}) {
   if (restoredMainSha !== originMainSha) {
     throw new Error(`release --abort removed ${tag}, but local main did not restore to origin/main; inspect before retrying`);
   }
+  const clearedLedgerNote = await clearReleaseLedger(process.cwd(), { repo: ctx.repo, tag, tagSha });
   return {
     command: "release-abort",
     repo: ctx.repo,
     tag,
     tagSha,
     restoredMainSha,
-    note: `removed the unpublished ${tag} candidate and restored local main; repair development before recutting`
+    note: `removed the unpublished ${tag} candidate and restored local main; repair development before recutting` + (clearedLedgerNote ? `; ${clearedLedgerNote}` : "")
   };
 }
 async function runReleasePublishRetry(deps, runId, options = {}) {
@@ -19732,6 +21051,25 @@ async function runReleasePublishRetry(deps, runId, options = {}) {
   if (options.watch && await watchTenantRun(deps, runId, ctx.repo) !== "success") {
     throw new Error(`publish run ${runId} did not finish successfully after retry`);
   }
+  const ledger = openReleaseLedgerWriter(process.cwd());
+  const existing = await ledger.load({ repo: ctx.repo, tag, tagSha }).catch(() => void 0);
+  let ledgerNote;
+  if (existing) {
+    const record = await ledger.record({ repo: ctx.repo, tag, tagSha }, "publish", phaseEntry({
+      state: options.watch ? "complete" : "pending",
+      sha: tagSha,
+      runId,
+      runUrl: run.url ?? `https://github.com/${ctx.repo}/actions/runs/${runId}`,
+      runRepo: ctx.repo,
+      runProvenance: "sha",
+      workflow: "publish.yml",
+      event: "release",
+      note: options.watch ? `publish run ${runId} retried via release --retry-publish and passed (live-proven)` : `publish run ${runId} queued for retry via release --retry-publish`
+    }));
+    ledgerNote = record.ok ? options.watch ? "publish boundary updated to complete in the release ledger" : "publish boundary updated to pending in the release ledger" : `release ledger not updated: ${record.error}`;
+  } else {
+    ledgerNote = "no release ledger on disk for this release \u2014 nothing to update";
+  }
   return {
     command: "release-retry-publish",
     repo: ctx.repo,
@@ -19740,12 +21078,18 @@ async function runReleasePublishRetry(deps, runId, options = {}) {
     runId,
     runUrl: run.url ?? `https://github.com/${ctx.repo}/actions/runs/${runId}`,
     status: options.watch ? "success" : "pending",
-    note: options.watch ? `publish run ${runId} retried and passed` : `publish run ${runId} queued for retry`
+    note: options.watch ? `publish run ${runId} retried and passed; ${ledgerNote}` : `publish run ${runId} queued for retry; ${ledgerNote}`
   };
 }
 async function runTrainApplyPipeline(mode, input) {
   const { deps, ctx, command, meta, branchHints, watch, options, bumpIntent } = input;
   const directTrack = input.directTrack ?? false;
+  const ledger = mode === "rcand" ? void 0 : openReleaseLedgerWriter(process.cwd());
+  if (ledger) {
+    const begin = await beginReleaseLedger(deps, process.cwd());
+    if (!begin.ok) throw new Error(`release refused before any mutation: ${begin.error}`);
+    else if (begin.note) deps.warn?.(`release ledger: ${begin.note}`);
+  }
   if (mode === "rcand") {
     await requireBranch(deps, "development");
     if (directTrack) {
@@ -19832,8 +21176,10 @@ async function runTrainApplyPipeline(mode, input) {
       const releaseSha3 = requireValue(clean2(await deps.run("git", ["rev-parse", "main"])), "release sha");
       return { versionFold: versionFold3, releaseSha: releaseSha3 };
     });
-    const { checks: checks2, releaseUrl: releaseUrl2, announceNote: announceNote2, dispatch: d2 } = await completeMainRelease(deps, ctx, meta, deployModel2, watch, options, tag2, releaseSha2, "development", preFold2, tagProbe2, branchHints);
+    const { checks: checks2, releaseUrl: releaseUrl2, announceNote: announceNote2, dispatch: d2, ledgerAnchors: ledgerAnchors2 } = await completeMainRelease(deps, ctx, meta, deployModel2, watch, options, tag2, releaseSha2, "development", preFold2, tagProbe2, branchHints, ledger);
     const devRollForward2 = await rollDevelopmentForward(deps, ctx, tag2);
+    await recordPhase(ledger, deps, ledgerAnchors2, "alignment", phaseEntry(alignmentPhaseEntry(devRollForward2)), { landed: "the immutable tag, the green wall, origin/main, the verified Release, and the deploy/publish path" });
+    const ledgerReport2 = releaseLedgerReport(await ledger?.load(ledgerAnchors2).catch(() => void 0), ledger?.path ?? "(no ledger)");
     if (directTrack) {
       return {
         ...ctx,
@@ -19856,11 +21202,14 @@ async function runTrainApplyPipeline(mode, input) {
         devRollForward: devRollForward2,
         announceNote: announceNote2,
         devNote: options.dev ? "--dev is a no-op on a direct-track repo \u2014 it already releases development -> main" : void 0,
-        release: { tag: tag2, url: releaseUrl2, targetSha: releaseSha2 }
+        release: { tag: tag2, url: releaseUrl2, targetSha: releaseSha2 },
+        ...ledgerReport2 ? { ledger: ledgerReport2 } : {}
       };
     }
     const retirement2 = hasRcBranch ? await retireRcRuntime(deps, ctx, deployModel2, d2.deployStatus, rcShaAtRelease) : { status: "not-applicable", note: "no origin/rc branch \u2014 rc runtime retirement skipped" };
     const rcAlignment2 = hasRcBranch ? await alignRcForward(deps, ctx, tag2) : void 0;
+    await recordPhase(ledger, deps, ledgerAnchors2, "alignment", phaseEntry(alignmentPhaseEntry(devRollForward2, rcAlignment2)), { landed: "the immutable tag, the green wall, origin/main, the verified Release, and the deploy/publish path" });
+    const fullLedgerReport = releaseLedgerReport(await ledger?.load(ledgerAnchors2).catch(() => void 0), ledger?.path ?? "(no ledger)");
     const environments2 = await buildEnvironments(deps, ctx, deployModel2, d2.deployStatus, retirement2);
     return {
       ...ctx,
@@ -19886,7 +21235,8 @@ async function runTrainApplyPipeline(mode, input) {
       announceNote: announceNote2,
       devNote: "released development -> main (--dev), skipping the rc candidate",
       release: { tag: tag2, url: releaseUrl2, targetSha: releaseSha2 },
-      environments: environments2
+      environments: environments2,
+      ...fullLedgerReport ? { ledger: fullLedgerReport } : {}
     };
   }
   await requireBranch(deps, "rc");
@@ -19919,10 +21269,12 @@ async function runTrainApplyPipeline(mode, input) {
     const releaseSha2 = requireValue(clean2(await deps.run("git", ["rev-parse", "main"])), "release sha");
     return { versionFold: versionFold2, releaseSha: releaseSha2 };
   });
-  const { checks, releaseUrl, announceNote, dispatch: d } = await completeMainRelease(deps, ctx, meta, deployModel, watch, options, tag, releaseSha, "rc", preFold, tagProbe, branchHints);
+  const { checks, releaseUrl, announceNote, dispatch: d, ledgerAnchors } = await completeMainRelease(deps, ctx, meta, deployModel, watch, options, tag, releaseSha, "rc", preFold, tagProbe, branchHints, ledger);
   const retirement = await retireRcRuntime(deps, ctx, deployModel, d.deployStatus, releasedRcSha);
   const devRollForward = await rollDevelopmentForward(deps, ctx, tag);
   const rcAlignment = await alignRcForward(deps, ctx, tag);
+  await recordPhase(ledger, deps, ledgerAnchors, "alignment", phaseEntry(alignmentPhaseEntry(devRollForward, rcAlignment)), { landed: "the immutable tag, the green wall, origin/main, the verified Release, and the deploy/publish path" });
+  const ledgerReport = releaseLedgerReport(await ledger?.load(ledgerAnchors).catch(() => void 0), ledger?.path ?? "(no ledger)");
   const environments = await buildEnvironments(deps, ctx, deployModel, d.deployStatus, retirement);
   return {
     ...ctx,
@@ -19947,7 +21299,8 @@ async function runTrainApplyPipeline(mode, input) {
     devRollForward,
     announceNote,
     release: { tag, url: releaseUrl, targetSha: releaseSha },
-    environments
+    environments,
+    ...ledgerReport ? { ledger: ledgerReport } : {}
   };
 }
 async function latestLocalReleaseTag(deps) {
@@ -21015,20 +22368,20 @@ async function applyCiReconcileRepo(repo, deps) {
 }
 
 // src/claude-binary-doctor.ts
-var import_node_fs21 = require("node:fs");
+var import_node_fs22 = require("node:fs");
 var import_node_os11 = require("node:os");
-var import_node_path19 = require("node:path");
+var import_node_path21 = require("node:path");
 
 // src/jerv-cli-spawn.ts
-var import_node_fs20 = require("node:fs");
+var import_node_fs21 = require("node:fs");
 var import_node_os10 = require("node:os");
-var import_node_path18 = require("node:path");
+var import_node_path20 = require("node:path");
 var WIN_NAMES = ["jerv-cli.cmd", "jerv-cli.exe", "jerv-cli"];
 var POSIX_NAMES = ["jerv-cli"];
-var JERV_CLI_ENTRY = (0, import_node_path18.join)("node_modules", "@jervaise", "jerv-cli", "dist", "index.cjs");
+var JERV_CLI_ENTRY = (0, import_node_path20.join)("node_modules", "@jervaise", "jerv-cli", "dist", "index.cjs");
 function pathEnvEntries(pathEnv, platform2 = process.platform) {
   if (platform2 !== "win32") {
-    return pathEnv.split(import_node_path18.delimiter).map((e) => e.trim()).filter(Boolean);
+    return pathEnv.split(import_node_path20.delimiter).map((e) => e.trim()).filter(Boolean);
   }
   if (pathEnv.includes(";")) {
     return pathEnv.split(";").map((e) => e.trim()).filter(Boolean);
@@ -21061,10 +22414,10 @@ function jervCliCandidateDirs(env = process.env, home = (0, import_node_os10.hom
     push(normalizeSpawnPathEntry(entry, platform2));
   }
   if (platform2 === "win32") {
-    if (env.APPDATA) push((0, import_node_path18.join)(env.APPDATA, "npm"));
-    if (env.LOCALAPPDATA) push((0, import_node_path18.join)(env.LOCALAPPDATA, "npm"));
+    if (env.APPDATA) push((0, import_node_path20.join)(env.APPDATA, "npm"));
+    if (env.LOCALAPPDATA) push((0, import_node_path20.join)(env.LOCALAPPDATA, "npm"));
   } else {
-    push((0, import_node_path18.join)(home, ".local", "bin"));
+    push((0, import_node_path20.join)(home, ".local", "bin"));
   }
   return out;
 }
@@ -21072,23 +22425,23 @@ function jervCliCandidatePaths(env = process.env, home = (0, import_node_os10.ho
   const names = platform2 === "win32" ? WIN_NAMES : POSIX_NAMES;
   const out = [];
   for (const dir of jervCliCandidateDirs(env, home, platform2)) {
-    for (const name of names) out.push((0, import_node_path18.join)(dir, name));
+    for (const name of names) out.push((0, import_node_path20.join)(dir, name));
   }
   return out;
 }
-function resolveJervCliPath(env = process.env, home = (0, import_node_os10.homedir)(), platform2 = process.platform, exists = import_node_fs20.existsSync) {
+function resolveJervCliPath(env = process.env, home = (0, import_node_os10.homedir)(), platform2 = process.platform, exists = import_node_fs21.existsSync) {
   for (const candidate of jervCliCandidatePaths(env, home, platform2)) {
     if (exists(candidate)) return candidate;
   }
   return void 0;
 }
-function resolveJervCliNodeEntry(shimPath, exists = import_node_fs20.existsSync) {
-  const entry = (0, import_node_path18.join)((0, import_node_path18.dirname)(shimPath), JERV_CLI_ENTRY);
+function resolveJervCliNodeEntry(shimPath, exists = import_node_fs21.existsSync) {
+  const entry = (0, import_node_path20.join)((0, import_node_path20.dirname)(shimPath), JERV_CLI_ENTRY);
   return exists(entry) ? entry : void 0;
 }
 function jervCliExecFileArgs(args, opts = {}) {
   const platform2 = opts.platform ?? process.platform;
-  const exists = opts.exists ?? import_node_fs20.existsSync;
+  const exists = opts.exists ?? import_node_fs21.existsSync;
   const resolved = resolveJervCliPath(opts.env ?? process.env, opts.home ?? (0, import_node_os10.homedir)(), platform2, exists);
   if (resolved) {
     const entry = resolveJervCliNodeEntry(resolved, exists);
@@ -21178,26 +22531,26 @@ function globalNodeModulesRoots(host) {
     out.push(dir);
   };
   const prefix = env.npm_config_prefix?.trim();
-  if (prefix) push(platform2 === "win32" ? (0, import_node_path19.join)(prefix, "node_modules") : (0, import_node_path19.join)(prefix, "lib", "node_modules"));
+  if (prefix) push(platform2 === "win32" ? (0, import_node_path21.join)(prefix, "node_modules") : (0, import_node_path21.join)(prefix, "lib", "node_modules"));
   for (const dir of jervCliCandidateDirs(env, host.home ?? (0, import_node_os11.homedir)(), platform2)) {
-    push((0, import_node_path19.join)(dir, "node_modules"));
-    push((0, import_node_path19.join)((0, import_node_path19.dirname)(dir), "lib", "node_modules"));
+    push((0, import_node_path21.join)(dir, "node_modules"));
+    push((0, import_node_path21.join)((0, import_node_path21.dirname)(dir), "lib", "node_modules"));
   }
   return out;
 }
 function readHead(path2) {
   let fd;
   try {
-    fd = (0, import_node_fs21.openSync)(path2, "r");
+    fd = (0, import_node_fs22.openSync)(path2, "r");
     const buffer = new Uint8Array(MAGIC_HEAD_BYTES);
-    const read = (0, import_node_fs21.readSync)(fd, buffer, 0, MAGIC_HEAD_BYTES, 0);
+    const read = (0, import_node_fs22.readSync)(fd, buffer, 0, MAGIC_HEAD_BYTES, 0);
     return buffer.subarray(0, read);
   } catch {
     return void 0;
   } finally {
     if (fd !== void 0) {
       try {
-        (0, import_node_fs21.closeSync)(fd);
+        (0, import_node_fs22.closeSync)(fd);
       } catch {
       }
     }
@@ -21205,7 +22558,7 @@ function readHead(path2) {
 }
 function fileBytes(path2) {
   try {
-    return (0, import_node_fs21.statSync)(path2).size;
+    return (0, import_node_fs22.statSync)(path2).size;
   } catch {
     return void 0;
   }
@@ -21219,17 +22572,17 @@ function readClaudeBinaryState(host = {}) {
   const arch = host.arch ?? process.arch;
   const magic = EXECUTABLE_MAGIC[platform2];
   if (!magic) return void 0;
-  const packageRoot = globalNodeModulesRoots(host).map((root) => (0, import_node_path19.join)(root, ...PACKAGE.split("/"))).find((dir) => (0, import_node_fs21.existsSync)((0, import_node_path19.join)(dir, "package.json")));
+  const packageRoot = globalNodeModulesRoots(host).map((root) => (0, import_node_path21.join)(root, ...PACKAGE.split("/"))).find((dir) => (0, import_node_fs22.existsSync)((0, import_node_path21.join)(dir, "package.json")));
   if (!packageRoot) return void 0;
   const keys = platformPackageKeys(platform2, arch);
   const fallbackPackage = `${PACKAGE}-${keys[0]}`;
   let manifest;
   try {
-    manifest = JSON.parse((0, import_node_fs21.readFileSync)((0, import_node_path19.join)(packageRoot, "package.json"), "utf8"));
+    manifest = JSON.parse((0, import_node_fs22.readFileSync)((0, import_node_path21.join)(packageRoot, "package.json"), "utf8"));
   } catch (e) {
     return {
       state: "unreadable",
-      binPath: (0, import_node_path19.join)(packageRoot, "package.json"),
+      binPath: (0, import_node_path21.join)(packageRoot, "package.json"),
       expectedMagic: magic.name,
       platformPackage: fallbackPackage,
       error: `package.json could not be read \u2014 ${e.message}`
@@ -21246,17 +22599,17 @@ function readClaudeBinaryState(host = {}) {
       error: "package.json declares no `bin` entry \u2014 the executed file cannot be resolved"
     };
   }
-  const binPath = (0, import_node_path19.join)(packageRoot, binRelative);
-  const binName = (0, import_node_path19.basename)(binRelative);
+  const binPath = (0, import_node_path21.join)(packageRoot, binRelative);
+  const binName = (0, import_node_path21.basename)(binRelative);
   const optional = manifest.optionalDependencies;
   const publishes = (name) => typeof optional === "object" && optional !== null && Object.prototype.hasOwnProperty.call(optional, name);
   const published = keys.map((key) => `${PACKAGE}-${key}`).filter(publishes);
   if (published.length === 0) return void 0;
   const binIn = (name) => [
-    (0, import_node_path19.join)(packageRoot, "node_modules", ...name.split("/"), binName),
-    (0, import_node_path19.join)((0, import_node_path19.dirname)((0, import_node_path19.dirname)(packageRoot)), ...name.split("/"), binName)
+    (0, import_node_path21.join)(packageRoot, "node_modules", ...name.split("/"), binName),
+    (0, import_node_path21.join)((0, import_node_path21.dirname)((0, import_node_path21.dirname)(packageRoot)), ...name.split("/"), binName)
   ];
-  const found = published.map((name) => ({ name, path: binIn(name).find((file) => (0, import_node_fs21.existsSync)(file)) })).find((c) => c.path);
+  const found = published.map((name) => ({ name, path: binIn(name).find((file) => (0, import_node_fs22.existsSync)(file)) })).find((c) => c.path);
   const platformPackage = found?.name ?? published[0];
   let source;
   let sourceProblem;
@@ -21267,7 +22620,7 @@ function readClaudeBinaryState(host = {}) {
   } else {
     source = { path: found.path, bytes: fileBytes(found.path) ?? 0 };
   }
-  if (!(0, import_node_fs21.existsSync)(binPath)) {
+  if (!(0, import_node_fs22.existsSync)(binPath)) {
     return { state: "missing", binPath, expectedMagic: magic.name, platformPackage, ...source ? { source } : {}, ...sourceProblem ? { sourceProblem } : {} };
   }
   const head = readHead(binPath);
@@ -21310,9 +22663,9 @@ function healClaudeBinary(host = {}, onStep) {
   const platform2 = host.platform ?? process.platform;
   const aside = `${probe.binPath}.stub-${Date.now()}`;
   let renamed = false;
-  if ((0, import_node_fs21.existsSync)(probe.binPath)) {
+  if ((0, import_node_fs22.existsSync)(probe.binPath)) {
     try {
-      (0, import_node_fs21.renameSync)(probe.binPath, aside);
+      (0, import_node_fs22.renameSync)(probe.binPath, aside);
       renamed = true;
       onStep?.(`renamed the stub aside: ${aside}`);
     } catch (e) {
@@ -21321,12 +22674,12 @@ function healClaudeBinary(host = {}, onStep) {
   }
   try {
     onStep?.(`copying ${probe.source.path} \u2192 ${probe.binPath} (${(probe.source.bytes / 1e6).toFixed(0)} MB)`);
-    (0, import_node_fs21.copyFileSync)(probe.source.path, probe.binPath);
-    if (platform2 !== "win32") (0, import_node_fs21.chmodSync)(probe.binPath, 493);
+    (0, import_node_fs22.copyFileSync)(probe.source.path, probe.binPath);
+    if (platform2 !== "win32") (0, import_node_fs22.chmodSync)(probe.binPath, 493);
   } catch (e) {
     if (renamed) {
       try {
-        (0, import_node_fs21.renameSync)(aside, probe.binPath);
+        (0, import_node_fs22.renameSync)(aside, probe.binPath);
       } catch {
         return { ok: false, detail: `copy failed (${e.message}) and the stub could not be restored \u2014 the original is at ${aside}` };
       }
@@ -21340,7 +22693,7 @@ function healClaudeBinary(host = {}, onStep) {
   let kept = false;
   if (renamed) {
     try {
-      (0, import_node_fs21.rmSync)(aside);
+      (0, import_node_fs22.rmSync)(aside);
     } catch {
       kept = true;
     }
@@ -22192,7 +23545,7 @@ function renderPluginCachePlan(plan, applied) {
 }
 
 // src/app-actor.ts
-var import_node_crypto5 = require("node:crypto");
+var import_node_crypto6 = require("node:crypto");
 var APP_ACTOR_ENV = "MMI_ACTOR";
 var APP_VAULT_REPO = "mutmutco/MMI-Hub";
 var APP_VAULT_KEYS = ["GITHUB_APP_ID", "GITHUB_APP_INSTALLATION_ID", "GITHUB_APP_PRIVATE_KEY"];
@@ -22236,7 +23589,7 @@ function mintAppJwt(appId, privateKeyPem, nowSec) {
     exp: now + APP_JWT_TTL_S,
     iss: appId
   }));
-  const signer = (0, import_node_crypto5.createSign)("RSA-SHA256");
+  const signer = (0, import_node_crypto6.createSign)("RSA-SHA256");
   signer.update(`${header}.${payload}`);
   return `${header}.${payload}.${signer.sign(privateKeyPem, "base64url")}`;
 }
@@ -22637,9 +23990,9 @@ function registerBoardCommands(program3) {
 }
 
 // src/bootstrap-commands.ts
-var import_node_fs23 = require("node:fs");
+var import_node_fs24 = require("node:fs");
 var import_node_os12 = require("node:os");
-var import_node_path21 = require("node:path");
+var import_node_path23 = require("node:path");
 
 // src/command-plans.ts
 function parseTrainTag(tag) {
@@ -22799,8 +24152,8 @@ function renderSteps(title, steps) {
 }
 
 // src/port-registry.ts
-var import_node_fs22 = require("node:fs");
-var import_node_path20 = require("node:path");
+var import_node_fs23 = require("node:fs");
+var import_node_path22 = require("node:path");
 
 // ../infra/port-geometry.mjs
 var PORT_BLOCK = 100;
@@ -22814,8 +24167,8 @@ function nextPortBlock(registry2) {
   return [base, base + PORT_SPAN];
 }
 function loadPortRegistry(path2) {
-  if (!(0, import_node_fs22.existsSync)(path2)) return {};
-  const raw = JSON.parse((0, import_node_fs22.readFileSync)(path2, "utf8"));
+  if (!(0, import_node_fs23.existsSync)(path2)) return {};
+  const raw = JSON.parse((0, import_node_fs23.readFileSync)(path2, "utf8"));
   const out = {};
   for (const [key, value] of Object.entries(raw)) {
     if (Array.isArray(value) && value.length === 2 && value.every((n) => typeof n === "number")) {
@@ -22829,9 +24182,9 @@ function ensurePortRange(repo, path2) {
   const existing = registry2[repo];
   if (existing) return existing;
   const range = nextPortBlock(registry2);
-  const raw = (0, import_node_fs22.existsSync)(path2) ? JSON.parse((0, import_node_fs22.readFileSync)(path2, "utf8")) : {};
+  const raw = (0, import_node_fs23.existsSync)(path2) ? JSON.parse((0, import_node_fs23.readFileSync)(path2, "utf8")) : {};
   raw[repo] = range;
-  (0, import_node_fs22.writeFileSync)(path2, JSON.stringify(raw, null, 2) + "\n", "utf8");
+  (0, import_node_fs23.writeFileSync)(path2, JSON.stringify(raw, null, 2) + "\n", "utf8");
   return range;
 }
 function portCursorSeed(registry2) {
@@ -22853,22 +24206,22 @@ function existingPortRange(repo, registry2) {
   return registry2[repo] ?? null;
 }
 function portRangeInfraAt(root, source) {
-  const registryPath = (0, import_node_path20.join)(root, "infra", "port-ranges.json");
-  const ddbScriptPath = (0, import_node_path20.join)(root, "infra", "port-ddb.mjs");
-  if (!(0, import_node_fs22.existsSync)(registryPath) || !(0, import_node_fs22.existsSync)(ddbScriptPath)) return null;
+  const registryPath = (0, import_node_path22.join)(root, "infra", "port-ranges.json");
+  const ddbScriptPath = (0, import_node_path22.join)(root, "infra", "port-ddb.mjs");
+  if (!(0, import_node_fs23.existsSync)(registryPath) || !(0, import_node_fs23.existsSync)(ddbScriptPath)) return null;
   return { root, source, registryPath, ddbScriptPath };
 }
 function resolvePortRangeInfra(cwd, packageDir) {
   const direct = portRangeInfraAt(cwd, "cwd");
   if (direct) return direct;
-  for (let dir = cwd; ; dir = (0, import_node_path20.dirname)(dir)) {
-    const sibling = portRangeInfraAt((0, import_node_path20.join)(dir, "MMI-Hub"), "sibling-hub");
+  for (let dir = cwd; ; dir = (0, import_node_path22.dirname)(dir)) {
+    const sibling = portRangeInfraAt((0, import_node_path22.join)(dir, "MMI-Hub"), "sibling-hub");
     if (sibling) return sibling;
-    const parent = (0, import_node_path20.dirname)(dir);
+    const parent = (0, import_node_path22.dirname)(dir);
     if (parent === dir) break;
   }
   if (packageDir) {
-    const pkgRoot = (0, import_node_path20.join)(packageDir, "..", "..");
+    const pkgRoot = (0, import_node_path22.join)(packageDir, "..", "..");
     const pkgFrom = portRangeInfraAt(pkgRoot, "pkg-root");
     if (pkgFrom) return pkgFrom;
   }
@@ -22930,7 +24283,7 @@ async function assignPersistedPortRange(repo, slug, reg, opts) {
 }
 
 // src/bootstrap-drift.ts
-var import_node_crypto6 = require("node:crypto");
+var import_node_crypto7 = require("node:crypto");
 function byteComparableSeeds(manifest, cls) {
   return manifest.seeds.filter((s) => s.ownership === "org" && s.source === "self" && s.classes.includes(cls));
 }
@@ -22950,7 +24303,7 @@ function compareSeedBytes(hubContent, repoContent) {
   return normalize(hubContent) === normalize(repoContent) ? "match" : "drift";
 }
 function seedContentHash(content) {
-  return (0, import_node_crypto6.createHash)("sha256").update(content.replace(/\r\n/g, "\n"), "utf8").digest("hex");
+  return (0, import_node_crypto7.createHash)("sha256").update(content.replace(/\r\n/g, "\n"), "utf8").digest("hex");
 }
 function auditRepoSeedDrift(repo, seeds, hubContents, repoReads) {
   const byTarget = new Map(repoReads.map((r) => [r.target, r.content]));
@@ -23112,7 +24465,7 @@ function renderPropagationReport(plan) {
 }
 
 // src/bootstrap-propagation-identity.ts
-var import_node_crypto7 = require("node:crypto");
+var import_node_crypto8 = require("node:crypto");
 var PROPAGATION_BRANCH_PREFIX = "seed-propagate-";
 var TARGET_MARKER_NAME = "mmi-bootstrap-propagation-target";
 function safeBranchPart(value, maxLength, fallback) {
@@ -23125,7 +24478,7 @@ function repoSlug2(repo) {
 function propagationBranch(repo, target) {
   const repoPart = safeBranchPart(repoSlug2(repo), 32, "repo");
   const targetPart = safeBranchPart(target, 48, "target");
-  const hash = (0, import_node_crypto7.createHash)("sha256").update(repo.trim().toLowerCase()).update("\0").update(target).digest("hex").slice(0, 12);
+  const hash = (0, import_node_crypto8.createHash)("sha256").update(repo.trim().toLowerCase()).update("\0").update(target).digest("hex").slice(0, 12);
   return `${PROPAGATION_BRANCH_PREFIX}${repoPart}-${targetPart}-${hash}`;
 }
 function legacyPropagationBranch(repo) {
@@ -23932,13 +25285,13 @@ function registerBootstrapCommands(program3) {
       client: defaultGitHubClient(),
       projectMeta: meta,
       deployModel: typeof meta?.deployModel === "string" ? meta.deployModel : void 0,
-      readLocalFile: (path2) => path2 === "projects.json" && apiProjects != null ? apiProjects : (0, import_node_fs23.existsSync)(path2) ? (0, import_node_fs23.readFileSync)(path2, "utf8") : null,
+      readLocalFile: (path2) => path2 === "projects.json" && apiProjects != null ? apiProjects : (0, import_node_fs24.existsSync)(path2) ? (0, import_node_fs24.readFileSync)(path2, "utf8") : null,
       // requiredGcpApis is stored as an array by a JSON write, but `org project set --var KEY=VALUE` stores a raw
       // comma-string — accept either so the seeded value verifies regardless of how it was written.
       // #3689: the same committed map the org access audit reads (#3664), so a sanctioned admin is not a
       // permanent bootstrap failure on one surface and an intended state on the other. Absent file → no
       // sanction, which is the pre-#3664 behaviour.
-      sanctionedAdmins: (0, import_node_fs23.existsSync)("access-matrix.json") ? entriesValueByCanonicalRepo(loadSanctionedAdmins((0, import_node_fs23.readFileSync)("access-matrix.json", "utf8")), repo) : void 0,
+      sanctionedAdmins: (0, import_node_fs24.existsSync)("access-matrix.json") ? entriesValueByCanonicalRepo(loadSanctionedAdmins((0, import_node_fs24.readFileSync)("access-matrix.json", "utf8")), repo) : void 0,
       requiredGcpApis: (() => {
         const v = meta?.requiredGcpApis;
         if (Array.isArray(v)) return v;
@@ -23991,14 +25344,14 @@ function registerBootstrapCommands(program3) {
   bootstrap.command("drift").description("#3818: compare every org-owned whole-file seed against MMI-Hub's copy across the registry roster; read-only").option("--repo <owner/repo>", "audit one repo instead of the roster (never a fleet verdict)").option("--json", "machine-readable output").action(async () => {
     const o = { repo: rawValue("--repo", ""), json: rawFlag("--json") };
     const manifestPath = "skills/bootstrap/seeds/manifest.json";
-    if (!(0, import_node_fs23.existsSync)(manifestPath)) return fail(`bootstrap drift: ${manifestPath} not found; run from the MMI-Hub repo root \u2014 the Hub's copies ARE the reference this compares against`);
+    if (!(0, import_node_fs24.existsSync)(manifestPath)) return fail(`bootstrap drift: ${manifestPath} not found; run from the MMI-Hub repo root \u2014 the Hub's copies ARE the reference this compares against`);
     const seedSource = await resolveHubSeedSource(execGitForSeedSource);
     if (!seedSource.ok) return fail(`bootstrap drift: ${seedSource.reason}`);
-    const manifest = loadBootstrapSeeds((0, import_node_fs23.readFileSync)(manifestPath, "utf8"));
+    const manifest = loadBootstrapSeeds((0, import_node_fs24.readFileSync)(manifestPath, "utf8"));
     const hubContents = /* @__PURE__ */ new Map();
     for (const s of manifest.seeds) {
       if (s.ownership !== "org" || s.source !== "self") continue;
-      hubContents.set(s.target, (0, import_node_fs23.existsSync)(s.target) ? (0, import_node_fs23.readFileSync)(s.target, "utf8") : null);
+      hubContents.set(s.target, (0, import_node_fs24.existsSync)(s.target) ? (0, import_node_fs24.readFileSync)(s.target, "utf8") : null);
     }
     let targets;
     let classOf = (_repo) => "deployable";
@@ -24116,10 +25469,10 @@ function registerBootstrapCommands(program3) {
       return;
     }
     const manifestPath = "skills/bootstrap/seeds/manifest.json";
-    if (!(0, import_node_fs23.existsSync)(manifestPath)) return fail(`bootstrap apply: ${manifestPath} not found; bootstrap runs from the MMI-Hub repo root by design \u2014 it stamps org-level resources (Project, Ruleset, secrets, access) through the GitHub App, which is only authorized from the Hub checkout`);
+    if (!(0, import_node_fs24.existsSync)(manifestPath)) return fail(`bootstrap apply: ${manifestPath} not found; bootstrap runs from the MMI-Hub repo root by design \u2014 it stamps org-level resources (Project, Ruleset, secrets, access) through the GitHub App, which is only authorized from the Hub checkout`);
     const seedSource = await resolveHubSeedSource(execGitForSeedSource);
     if (!seedSource.ok) return fail(`bootstrap apply: ${seedSource.reason}`);
-    const manifest = loadBootstrapSeeds((0, import_node_fs23.readFileSync)(manifestPath, "utf8"));
+    const manifest = loadBootstrapSeeds((0, import_node_fs24.readFileSync)(manifestPath, "utf8"));
     const baseBranch = o.class === "content" ? "main" : "development";
     const slug = parsedRepo.slug;
     const onlyTarget = o.only.trim();
@@ -24131,16 +25484,16 @@ function registerBootstrapCommands(program3) {
     }
     const onlyManagedBlock = onlyTarget ? seedsToApply[0]?.managedBlock != null : false;
     const gh = async (args) => execFileP("gh", args, { timeout: 2e4 });
-    const readFile8 = (p) => (0, import_node_fs23.existsSync)(p) ? (0, import_node_fs23.readFileSync)(p, "utf8") : null;
+    const readFile8 = (p) => (0, import_node_fs24.existsSync)(p) ? (0, import_node_fs24.readFileSync)(p, "utf8") : null;
     const enc = (p) => p.split("/").map(encodeURIComponent).join("/");
     const putSeed = async (target, content, ref, sha) => {
-      const tmp = (0, import_node_path21.join)((0, import_node_os12.tmpdir)(), `mmi-seed-${process.pid}-${Date.now().toString(36)}-${Math.random().toString(36).slice(2)}.json`);
-      (0, import_node_fs23.writeFileSync)(tmp, JSON.stringify(contentPutBody(target, content, ref, sha)), "utf8");
+      const tmp = (0, import_node_path23.join)((0, import_node_os12.tmpdir)(), `mmi-seed-${process.pid}-${Date.now().toString(36)}-${Math.random().toString(36).slice(2)}.json`);
+      (0, import_node_fs24.writeFileSync)(tmp, JSON.stringify(contentPutBody(target, content, ref, sha)), "utf8");
       try {
         await gh(contentPutInputArgs(repo, target, tmp));
       } finally {
         try {
-          (0, import_node_fs23.unlinkSync)(tmp);
+          (0, import_node_fs24.unlinkSync)(tmp);
         } catch {
         }
       }
@@ -24455,10 +25808,10 @@ LIVE apply to ${repo}:
   bootstrap.command("propagate").description("#4238: re-entrant canary\u2192wave tick \u2014 plan (or, with --execute, open) per-repo PRs fanning an org-owned seed out to the fleet").option("--target <path>", "the manifest target to propagate (an org-owned whole file or declared Hub-managed block)").option("--execute", "LIVE tick via gh (master-gated) \u2014 opens/reuses per-repo seed-propagate PRs; dry-run prints the plan only").option("--json", "machine-readable output").action(async () => {
     const o = { target: rawValue("--target", ""), execute: rawFlag("--execute"), json: rawFlag("--json") };
     const manifestPath = "skills/bootstrap/seeds/manifest.json";
-    if (!(0, import_node_fs23.existsSync)(manifestPath)) return fail(`bootstrap propagate: ${manifestPath} not found; run from the MMI-Hub repo root \u2014 the Hub's copies ARE the desired state this tick propagates`);
+    if (!(0, import_node_fs24.existsSync)(manifestPath)) return fail(`bootstrap propagate: ${manifestPath} not found; run from the MMI-Hub repo root \u2014 the Hub's copies ARE the desired state this tick propagates`);
     const seedSource = await resolveHubSeedSource(execGitForSeedSource);
     if (!seedSource.ok) return fail(`bootstrap propagate: ${seedSource.reason}`);
-    const manifest = loadBootstrapSeeds((0, import_node_fs23.readFileSync)(manifestPath, "utf8"));
+    const manifest = loadBootstrapSeeds((0, import_node_fs24.readFileSync)(manifestPath, "utf8"));
     const propagatable = manifest.seeds.filter(isPropagatableSeed);
     if (!o.target) {
       return fail(`bootstrap propagate: --target <path> is required \u2014 one of:
@@ -24467,9 +25820,9 @@ LIVE apply to ${repo}:
     const seed = propagatable.find((s) => s.target === o.target);
     if (!seed) return fail(`bootstrap propagate: --target '${o.target}' names no centrally propagatable seed in ${manifestPath}. Propagatable targets:
   ${propagatable.map((s) => s.target).join("\n  ")}`);
-    if (!seed.managedBlock && !(0, import_node_fs23.existsSync)(seed.target)) return fail(`bootstrap propagate: the Hub's own copy of '${seed.target}' is missing \u2014 nothing to propagate`);
-    const hubContent = seed.managedBlock ? null : (0, import_node_fs23.readFileSync)(seed.target, "utf8");
-    const readSeedFile = (path2) => (0, import_node_fs23.existsSync)(path2) ? (0, import_node_fs23.readFileSync)(path2, "utf8") : null;
+    if (!seed.managedBlock && !(0, import_node_fs24.existsSync)(seed.target)) return fail(`bootstrap propagate: the Hub's own copy of '${seed.target}' is missing \u2014 nothing to propagate`);
+    const hubContent = seed.managedBlock ? null : (0, import_node_fs24.readFileSync)(seed.target, "utf8");
+    const readSeedFile = (path2) => (0, import_node_fs24.existsSync)(path2) ? (0, import_node_fs24.readFileSync)(path2, "utf8") : null;
     const isWorkflowSeed = seed.target.startsWith(".github/workflows/");
     const cfg = await loadConfig();
     const projects = await fetchProjectsList(registryClientDeps(cfg));
@@ -24478,9 +25831,9 @@ LIVE apply to ${repo}:
     }
     const rosterRepos = collectRegistryRepos(projects).filter((r) => r.toLowerCase() !== "mutmutco/mmi-hub");
     let independentCount = rosterRepos.length;
-    if ((0, import_node_fs23.existsSync)("projects.json")) {
+    if ((0, import_node_fs24.existsSync)("projects.json")) {
       try {
-        const local = JSON.parse((0, import_node_fs23.readFileSync)("projects.json", "utf8"));
+        const local = JSON.parse((0, import_node_fs24.readFileSync)("projects.json", "utf8"));
         const localRepos = /* @__PURE__ */ new Set();
         for (const p of local.projects ?? []) for (const r of p.repos ?? []) {
           const full = (r.includes("/") ? r : `mutmutco/${r}`).toLowerCase();
@@ -24640,15 +25993,15 @@ LIVE apply to ${repo}:
         } catch {
           existingSha = void 0;
         }
-        const tmp = (0, import_node_path21.join)((0, import_node_os12.tmpdir)(), `mmi-propagate-${process.pid}-${Date.now().toString(36)}-${Math.random().toString(36).slice(2)}.json`);
+        const tmp = (0, import_node_path23.join)((0, import_node_os12.tmpdir)(), `mmi-propagate-${process.pid}-${Date.now().toString(36)}-${Math.random().toString(36).slice(2)}.json`);
         const desiredContent = desiredByRepo.get(rec.repo);
         if (desiredContent == null) return fail(`bootstrap propagate: no resolved content for ${rec.repo} ${seed.target} \u2014 refusing to write`);
-        (0, import_node_fs23.writeFileSync)(tmp, JSON.stringify(contentPutBody(seed.target, desiredContent, branch, existingSha)), "utf8");
+        (0, import_node_fs24.writeFileSync)(tmp, JSON.stringify(contentPutBody(seed.target, desiredContent, branch, existingSha)), "utf8");
         try {
           await gh(contentPutInputArgs(rec.repo, seed.target, tmp));
         } finally {
           try {
-            (0, import_node_fs23.unlinkSync)(tmp);
+            (0, import_node_fs24.unlinkSync)(tmp);
           } catch {
           }
         }
@@ -24715,10 +26068,10 @@ Rollback: \`mmi-cli devops bootstrap rollback ${rec.repo} --target ${seed.target
       return fail(`bootstrap rollback: ${e.message}`);
     }
     const manifestPath = "skills/bootstrap/seeds/manifest.json";
-    if (!(0, import_node_fs23.existsSync)(manifestPath)) return fail(`bootstrap rollback: ${manifestPath} not found; run from the MMI-Hub repo root \u2014 the manifest names which targets are org-owned and therefore propagated (and rollback-able)`);
+    if (!(0, import_node_fs24.existsSync)(manifestPath)) return fail(`bootstrap rollback: ${manifestPath} not found; run from the MMI-Hub repo root \u2014 the manifest names which targets are org-owned and therefore propagated (and rollback-able)`);
     const seedSource = await resolveHubSeedSource(execGitForSeedSource);
     if (!seedSource.ok) return fail(`bootstrap rollback: ${seedSource.reason}`);
-    const manifest = loadBootstrapSeeds((0, import_node_fs23.readFileSync)(manifestPath, "utf8"));
+    const manifest = loadBootstrapSeeds((0, import_node_fs24.readFileSync)(manifestPath, "utf8"));
     const propagatable = manifest.seeds.filter(isPropagatableSeed);
     if (!o.target) {
       return fail(`bootstrap rollback: --target <path> is required \u2014 one of:
@@ -24735,10 +26088,10 @@ Rollback: \`mmi-cli devops bootstrap rollback ${rec.repo} --target ${seed.target
     const enc = (p) => p.split("/").map(encodeURIComponent).join("/");
     let candidates;
     if (o.record) {
-      if (!(0, import_node_fs23.existsSync)(o.record)) return fail(`bootstrap rollback: --record '${o.record}' not found`);
+      if (!(0, import_node_fs24.existsSync)(o.record)) return fail(`bootstrap rollback: --record '${o.record}' not found`);
       let parsed;
       try {
-        parsed = JSON.parse((0, import_node_fs23.readFileSync)(o.record, "utf8"));
+        parsed = JSON.parse((0, import_node_fs24.readFileSync)(o.record, "utf8"));
       } catch (e) {
         return fail(`bootstrap rollback: --record '${o.record}' is not valid JSON: ${e.message}`);
       }
@@ -24815,13 +26168,13 @@ Rollback: \`mmi-cli devops bootstrap rollback ${rec.repo} --target ${seed.target
       } catch {
         existingSha = void 0;
       }
-      const tmp = (0, import_node_path21.join)((0, import_node_os12.tmpdir)(), `mmi-rollback-${process.pid}-${Date.now().toString(36)}-${Math.random().toString(36).slice(2)}.json`);
-      (0, import_node_fs23.writeFileSync)(tmp, JSON.stringify(contentPutBody(seed.target, preSeedContent, plan.branch, existingSha)), "utf8");
+      const tmp = (0, import_node_path23.join)((0, import_node_os12.tmpdir)(), `mmi-rollback-${process.pid}-${Date.now().toString(36)}-${Math.random().toString(36).slice(2)}.json`);
+      (0, import_node_fs24.writeFileSync)(tmp, JSON.stringify(contentPutBody(seed.target, preSeedContent, plan.branch, existingSha)), "utf8");
       try {
         await gh(contentPutInputArgs(repo, seed.target, tmp));
       } finally {
         try {
-          (0, import_node_fs23.unlinkSync)(tmp);
+          (0, import_node_fs24.unlinkSync)(tmp);
         } catch {
         }
       }
@@ -25814,7 +27167,7 @@ function renderDeployPortDoctor(report) {
 }
 
 // src/wave-status.ts
-var import_node_fs26 = require("node:fs");
+var import_node_fs27 = require("node:fs");
 
 // src/git-worktree-observation.ts
 function parseGitWorktreePorcelain(text) {
@@ -25845,8 +27198,8 @@ function deriveComposeProjectName(worktreePath) {
 
 // src/stage-runner.ts
 var import_node_child_process8 = require("node:child_process");
-var import_node_fs25 = require("node:fs");
-var import_node_path23 = require("node:path");
+var import_node_fs26 = require("node:fs");
+var import_node_path25 = require("node:path");
 var import_node_net = require("node:net");
 var import_node_util4 = require("node:util");
 
@@ -25856,8 +27209,8 @@ function normalizeEol2(s) {
 }
 
 // src/env-detection.ts
-var import_node_fs24 = require("node:fs");
-var import_node_path22 = require("node:path");
+var import_node_fs25 = require("node:fs");
+var import_node_path24 = require("node:path");
 var SKIPPED_DIRS = /* @__PURE__ */ new Set([".git", "node_modules", "dist", ".jerv", ".pi", ".venv", "venv"]);
 function isEnvBaseName(name) {
   return name.toLowerCase() === ".env";
@@ -25867,7 +27220,7 @@ function findEnvFiles(root) {
   const walk2 = (dir, rel) => {
     let entries;
     try {
-      entries = (0, import_node_fs24.readdirSync)(dir, { withFileTypes: true });
+      entries = (0, import_node_fs25.readdirSync)(dir, { withFileTypes: true });
     } catch {
       return;
     }
@@ -25875,13 +27228,13 @@ function findEnvFiles(root) {
       const relPath = rel ? `${rel}/${entry.name}` : entry.name;
       if (entry.isDirectory()) {
         if (SKIPPED_DIRS.has(entry.name)) continue;
-        walk2((0, import_node_path22.join)(dir, entry.name), relPath);
+        walk2((0, import_node_path24.join)(dir, entry.name), relPath);
         continue;
       }
       if (isEnvBaseName(entry.name)) {
         let isDir = false;
         try {
-          isDir = (0, import_node_fs24.lstatSync)((0, import_node_path22.join)(dir, entry.name)).isDirectory();
+          isDir = (0, import_node_fs25.lstatSync)((0, import_node_path24.join)(dir, entry.name)).isDirectory();
         } catch {
         }
         if (!isDir) found.push(relPath);
@@ -25912,7 +27265,7 @@ function healthPollIntervalMs() {
   return HEALTH_POLL_INTERVAL_MS;
 }
 function waitForProcessStability(child2, graceMs = earlyExitGraceMs()) {
-  return new Promise((resolve6, reject) => {
+  return new Promise((resolve7, reject) => {
     let settled = false;
     const finish = (fn) => {
       if (settled) return;
@@ -25922,7 +27275,7 @@ function waitForProcessStability(child2, graceMs = earlyExitGraceMs()) {
       child2.removeAllListeners("exit");
       fn();
     };
-    const timer = setTimeout(() => finish(resolve6), graceMs);
+    const timer = setTimeout(() => finish(resolve7), graceMs);
     child2.on("error", (err) => finish(() => reject(new Error(`stage process failed to start: ${err.message}`))));
     child2.on("exit", (code, signal) => {
       const detail = code != null ? `code ${code}` : signal ? `signal ${signal}` : "unknown reason";
@@ -26022,7 +27375,7 @@ function appendForceRecreate(up) {
   return `${up.trimEnd()} --force-recreate`;
 }
 function stageStatePath(cwd = process.cwd()) {
-  return (0, import_node_path23.join)(cwd, "tmp", "stage", "state.json");
+  return (0, import_node_path25.join)(cwd, "tmp", "stage", "state.json");
 }
 function normPath(path2) {
   return path2.replace(/\\/g, "/").replace(/\/+$/, "").toLowerCase();
@@ -26128,10 +27481,10 @@ function pickStagePort(range, isFree) {
   throw new Error(`no free stage port in range ${start}-${end} \u2014 every port is in use`);
 }
 function isPortFree(port) {
-  return new Promise((resolve6) => {
+  return new Promise((resolve7) => {
     const srv = (0, import_node_net.createServer)();
-    srv.once("error", () => resolve6(false));
-    srv.once("listening", () => srv.close(() => resolve6(true)));
+    srv.once("error", () => resolve7(false));
+    srv.once("listening", () => srv.close(() => resolve7(true)));
     srv.listen(port, "127.0.0.1");
   });
 }
@@ -26246,14 +27599,14 @@ function stageProcessEnv(stagePort, extraEnv) {
 }
 async function ensureStageRuntimeEnv(config, opts, cwd) {
   if (!config.ensureEnv) return;
-  const target = (0, import_node_path23.join)(cwd, config.ensureEnv.target);
-  const example = (0, import_node_path23.join)(cwd, config.ensureEnv.example);
-  if (!(0, import_node_fs25.existsSync)(target) && (0, import_node_fs25.existsSync)(example)) {
-    (0, import_node_fs25.copyFileSync)(example, target);
-  } else if ((0, import_node_fs25.existsSync)(target) && (0, import_node_fs25.existsSync)(example)) {
-    const stale = detectStaleEnvFile((0, import_node_fs25.readFileSync)(example, "utf8"), (0, import_node_fs25.readFileSync)(target, "utf8"), {
-      exampleMtimeMs: (0, import_node_fs25.statSync)(example).mtimeMs,
-      targetMtimeMs: (0, import_node_fs25.statSync)(target).mtimeMs
+  const target = (0, import_node_path25.join)(cwd, config.ensureEnv.target);
+  const example = (0, import_node_path25.join)(cwd, config.ensureEnv.example);
+  if (!(0, import_node_fs26.existsSync)(target) && (0, import_node_fs26.existsSync)(example)) {
+    (0, import_node_fs26.copyFileSync)(example, target);
+  } else if ((0, import_node_fs26.existsSync)(target) && (0, import_node_fs26.existsSync)(example)) {
+    const stale = detectStaleEnvFile((0, import_node_fs26.readFileSync)(example, "utf8"), (0, import_node_fs26.readFileSync)(target, "utf8"), {
+      exampleMtimeMs: (0, import_node_fs26.statSync)(example).mtimeMs,
+      targetMtimeMs: (0, import_node_fs26.statSync)(target).mtimeMs
     });
     if (stale) {
       const msg = `stale ${config.ensureEnv.target} (${stale}) \u2014 delete it or refresh from ${config.ensureEnv.example} before re-running /stage`;
@@ -26261,8 +27614,8 @@ async function ensureStageRuntimeEnv(config, opts, cwd) {
       console.error(`mmi-cli stage: ${msg} (allowed via --allow-stale-env)`);
     }
   }
-  if (opts.vaultEnvMerge && Object.keys(opts.vaultEnvMerge).length && (0, import_node_fs25.existsSync)(target)) {
-    (0, import_node_fs25.writeFileSync)(target, mergeEnvSecretsIntoFile((0, import_node_fs25.readFileSync)(target, "utf8"), opts.vaultEnvMerge), "utf8");
+  if (opts.vaultEnvMerge && Object.keys(opts.vaultEnvMerge).length && (0, import_node_fs26.existsSync)(target)) {
+    (0, import_node_fs26.writeFileSync)(target, mergeEnvSecretsIntoFile((0, import_node_fs26.readFileSync)(target, "utf8"), opts.vaultEnvMerge), "utf8");
   }
 }
 async function gitText(cwd, args) {
@@ -26292,20 +27645,20 @@ async function resolveGlobalStatePath(cwd, explicit) {
   return void 0;
 }
 function readState(path2) {
-  if (!(0, import_node_fs25.existsSync)(path2)) return null;
+  if (!(0, import_node_fs26.existsSync)(path2)) return null;
   try {
-    return JSON.parse((0, import_node_fs25.readFileSync)(path2, "utf8"));
+    return JSON.parse((0, import_node_fs26.readFileSync)(path2, "utf8"));
   } catch {
     return null;
   }
 }
 function mkdirFor(path2) {
   const dir = path2.slice(0, Math.max(path2.lastIndexOf("/"), path2.lastIndexOf("\\")));
-  (0, import_node_fs25.mkdirSync)(dir, { recursive: true });
+  (0, import_node_fs26.mkdirSync)(dir, { recursive: true });
 }
 function writeState(path2, state) {
   mkdirFor(path2);
-  (0, import_node_fs25.writeFileSync)(path2, JSON.stringify(state, null, 2), "utf8");
+  (0, import_node_fs26.writeFileSync)(path2, JSON.stringify(state, null, 2), "utf8");
 }
 function writeStagePortReservation(port, cwd, statePath, globalStatePath, now) {
   const reservation = {
@@ -26325,7 +27678,7 @@ async function cleanupStageState(state, paths, timeoutMs, fallbackCwd) {
     await shell(state.teardown.command.trim(), state.teardown.cwd || state.cwd || fallbackCwd, Math.max(timeoutMs, 1e4));
   }
   for (const path2 of [...new Set(paths.filter((p) => Boolean(p)))]) {
-    (0, import_node_fs25.rmSync)(path2, { force: true });
+    (0, import_node_fs26.rmSync)(path2, { force: true });
   }
 }
 async function killTree(pid) {
@@ -26342,7 +27695,7 @@ async function killTree(pid) {
     } catch {
     }
   }
-  await new Promise((resolve6) => setTimeout(resolve6, 500));
+  await new Promise((resolve7) => setTimeout(resolve7, 500));
   try {
     process.kill(-pid, "SIGKILL");
   } catch {
@@ -26363,7 +27716,7 @@ async function waitForHealth(url, timeoutMs, anyStatus = false) {
     } catch (e) {
       last = e.message;
     }
-    await new Promise((resolve6) => setTimeout(resolve6, healthPollIntervalMs()));
+    await new Promise((resolve7) => setTimeout(resolve7, healthPollIntervalMs()));
   }
   throw new Error(`stage health check timed out for ${url}${last ? ` (${last})` : ""}`);
 }
@@ -26495,8 +27848,8 @@ async function runStage(config = {}, opts = {}) {
       });
     }
   } catch (e) {
-    (0, import_node_fs25.rmSync)(statePath, { force: true });
-    if (globalStatePath && globalStatePath !== statePath) (0, import_node_fs25.rmSync)(globalStatePath, { force: true });
+    (0, import_node_fs26.rmSync)(statePath, { force: true });
+    if (globalStatePath && globalStatePath !== statePath) (0, import_node_fs26.rmSync)(globalStatePath, { force: true });
     throw e;
   }
   const started = await startStage(config, {
@@ -26513,9 +27866,9 @@ async function runStage(config = {}, opts = {}) {
 // src/wave-status.ts
 function readStageSummary(worktreePath) {
   const statePath = stageStatePath(worktreePath);
-  if (!(0, import_node_fs26.existsSync)(statePath)) return void 0;
+  if (!(0, import_node_fs27.existsSync)(statePath)) return void 0;
   try {
-    const state = JSON.parse((0, import_node_fs26.readFileSync)(statePath, "utf8"));
+    const state = JSON.parse((0, import_node_fs27.readFileSync)(statePath, "utf8"));
     const port = typeof state.port === "number" ? state.port : void 0;
     if (port == null || !Number.isInteger(port) || port <= 0) return void 0;
     return { port, url: typeof state.url === "string" ? state.url : void 0 };
@@ -26570,9 +27923,9 @@ async function collectWaveStatus(deps) {
 }
 
 // src/discovery-commands.ts
-var import_node_fs27 = require("node:fs");
+var import_node_fs28 = require("node:fs");
 var import_node_os13 = require("node:os");
-var import_node_path24 = require("node:path");
+var import_node_path26 = require("node:path");
 var GC_GH_TIMEOUT_MS = 2e4;
 async function collectStatus() {
   const repo = await resolveRepo();
@@ -26762,8 +28115,8 @@ async function collectOnboardStatus(opts = {}) {
   }
   const home = (0, import_node_os13.homedir)();
   const plugin = onboardPluginGate({
-    readKnown: () => readFileSyncSafe((0, import_node_path24.join)(home, ...KNOWN_MARKETPLACES_RELATIVE), import_node_fs27.readFileSync),
-    readSettings: () => readFileSyncSafe((0, import_node_path24.join)(home, ".claude", "settings.json"), import_node_fs27.readFileSync)
+    readKnown: () => readFileSyncSafe((0, import_node_path26.join)(home, ...KNOWN_MARKETPLACES_RELATIVE), import_node_fs28.readFileSync),
+    readSettings: () => readFileSyncSafe((0, import_node_path26.join)(home, ".claude", "settings.json"), import_node_fs28.readFileSync)
   });
   return { track, board, registry: registry2, secrets, plugin, doors: opts.doors ?? [], nextCommand };
 }
@@ -28794,9 +30147,9 @@ async function runDoctorClean(opts, io, deps) {
 }
 
 // src/doctor-io.ts
-var import_node_fs28 = require("node:fs");
+var import_node_fs29 = require("node:fs");
 var import_node_os14 = require("node:os");
-var import_node_path25 = require("node:path");
+var import_node_path27 = require("node:path");
 var import_node_child_process9 = require("node:child_process");
 var import_node_util5 = require("node:util");
 
@@ -28809,8 +30162,8 @@ function nodeDiscardSinkPath(platform2 = process.platform) {
 var execFileP3 = (0, import_node_util5.promisify)(import_node_child_process9.execFile);
 function execFileCapture(file, args, opts = {}) {
   const sink = nodeDiscardSinkPath();
-  const inFd = (0, import_node_fs28.openSync)(sink, "r");
-  const errFd = (0, import_node_fs28.openSync)(sink, "w");
+  const inFd = (0, import_node_fs29.openSync)(sink, "r");
+  const errFd = (0, import_node_fs29.openSync)(sink, "w");
   try {
     return (0, import_node_child_process9.execFileSync)(file, args, {
       ...opts,
@@ -28818,17 +30171,17 @@ function execFileCapture(file, args, opts = {}) {
       stdio: [inFd, "pipe", errFd]
     });
   } finally {
-    (0, import_node_fs28.closeSync)(inFd);
-    (0, import_node_fs28.closeSync)(errFd);
+    (0, import_node_fs29.closeSync)(inFd);
+    (0, import_node_fs29.closeSync)(errFd);
   }
 }
 var MMI_PLUGIN_ID2 = "mmi@mutmutco";
 function stagedClaudePluginVersion() {
   try {
-    const stagingRoot = (0, import_node_path25.join)((0, import_node_os14.homedir)(), ".claude", "plugins", "staging");
-    const record = JSON.parse((0, import_node_fs28.readFileSync)((0, import_node_path25.join)(stagingRoot, "launch-target.json"), "utf8"));
+    const stagingRoot = (0, import_node_path27.join)((0, import_node_os14.homedir)(), ".claude", "plugins", "staging");
+    const record = JSON.parse((0, import_node_fs29.readFileSync)((0, import_node_path27.join)(stagingRoot, "launch-target.json"), "utf8"));
     if (typeof record.target !== "string" || typeof record.incoming !== "string") return void 0;
-    const manifest = JSON.parse((0, import_node_fs28.readFileSync)((0, import_node_path25.join)(record.incoming, ".claude-plugin", "plugin.json"), "utf8"));
+    const manifest = JSON.parse((0, import_node_fs29.readFileSync)((0, import_node_path27.join)(record.incoming, ".claude-plugin", "plugin.json"), "utf8"));
     if (typeof manifest.version !== "string") return void 0;
     return manifest.version === record.target ? record.target : void 0;
   } catch {
@@ -28838,7 +30191,7 @@ function stagedClaudePluginVersion() {
 function installedClaudePluginVersion() {
   try {
     const file = JSON.parse(
-      (0, import_node_fs28.readFileSync)((0, import_node_path25.join)((0, import_node_os14.homedir)(), ".claude", "plugins", "installed_plugins.json"), "utf8")
+      (0, import_node_fs29.readFileSync)((0, import_node_path27.join)((0, import_node_os14.homedir)(), ".claude", "plugins", "installed_plugins.json"), "utf8")
     );
     const versions = (file.plugins?.[MMI_PLUGIN_ID2] ?? []).map((r) => r.version).filter((v) => Boolean(v));
     if (versions.length === 0) return void 0;
@@ -28849,7 +30202,7 @@ function installedClaudePluginVersion() {
 }
 function manifestVersion(path2) {
   try {
-    const manifest = JSON.parse((0, import_node_fs28.readFileSync)(path2, "utf8"));
+    const manifest = JSON.parse((0, import_node_fs29.readFileSync)(path2, "utf8"));
     return typeof manifest.version === "string" && manifest.version.trim() ? manifest.version.trim() : void 0;
   } catch {
     return void 0;
@@ -28858,12 +30211,12 @@ function manifestVersion(path2) {
 function readHermesPluginEvidence(env = process.env) {
   const host = hermesConfigRoot(env);
   const root = hermesPluginRoot(env);
-  const installRecordPresent = (0, import_node_fs28.existsSync)(root);
-  const manifestPath = (0, import_node_path25.join)(root, "plugin.yaml");
+  const installRecordPresent = (0, import_node_fs29.existsSync)(root);
+  const manifestPath = (0, import_node_path27.join)(root, "plugin.yaml");
   let installedVersion;
   let manifest = "missing";
   try {
-    const text = (0, import_node_fs28.readFileSync)(manifestPath, "utf8");
+    const text = (0, import_node_fs29.readFileSync)(manifestPath, "utf8");
     let version;
     try {
       const parsed = JSON.parse(text).version;
@@ -28877,20 +30230,20 @@ function readHermesPluginEvidence(env = process.env) {
     if (version) {
       installedVersion = version;
       manifest = "valid";
-    } else if ((0, import_node_fs28.existsSync)(manifestPath)) manifest = "invalid";
+    } else if ((0, import_node_fs29.existsSync)(manifestPath)) manifest = "invalid";
   } catch {
-    if ((0, import_node_fs28.existsSync)(manifestPath)) manifest = "invalid";
+    if ((0, import_node_fs29.existsSync)(manifestPath)) manifest = "invalid";
   }
   let skills = false;
   try {
-    skills = (0, import_node_fs28.existsSync)((0, import_node_path25.join)(root, "skills")) && (0, import_node_fs28.statSync)((0, import_node_path25.join)(root, "skills")).isDirectory();
+    skills = (0, import_node_fs29.existsSync)((0, import_node_path27.join)(root, "skills")) && (0, import_node_fs29.statSync)((0, import_node_path27.join)(root, "skills")).isDirectory();
   } catch {
   }
   return {
-    hostPresent: (0, import_node_fs28.existsSync)(host),
+    hostPresent: (0, import_node_fs29.existsSync)(host),
     installRecordPresent,
     manifest,
-    payloadPresent: (0, import_node_fs28.existsSync)((0, import_node_path25.join)(root, "__init__.py")) && skills && manifest === "valid",
+    payloadPresent: (0, import_node_fs29.existsSync)((0, import_node_path27.join)(root, "__init__.py")) && skills && manifest === "valid",
     ...installedVersion ? { installedVersion } : {}
   };
 }
@@ -28898,7 +30251,7 @@ function installedSurfacePluginVersion(surface) {
   const token = surfaceToken(surface);
   if (token === "hermes") return readHermesPluginEvidence().installedVersion;
   if (token === "cursor") {
-    return manifestVersion((0, import_node_path25.join)(cursorLocalPluginRoot(), ".cursor-plugin", "plugin.json"));
+    return manifestVersion((0, import_node_path27.join)(cursorLocalPluginRoot(), ".cursor-plugin", "plugin.json"));
   }
   if (token === "jervcode") {
     return installedJervCodePackageVersion();
@@ -28935,13 +30288,13 @@ function worktreeRootSync() {
 }
 var gitignorePath = () => {
   const root = worktreeRootSync();
-  return root === null ? null : (0, import_node_path25.join)(root, ".gitignore");
+  return root === null ? null : (0, import_node_path27.join)(root, ".gitignore");
 };
 function readGitignore() {
   const path2 = gitignorePath();
   if (path2 === null) return null;
   try {
-    return (0, import_node_fs28.readFileSync)(path2, "utf8");
+    return (0, import_node_fs29.readFileSync)(path2, "utf8");
   } catch {
     return null;
   }
@@ -28950,14 +30303,14 @@ function writeGitignore(content) {
   const path2 = gitignorePath();
   if (path2 === null) return false;
   try {
-    (0, import_node_fs28.writeFileSync)(path2, content, "utf8");
+    (0, import_node_fs29.writeFileSync)(path2, content, "utf8");
     return true;
   } catch {
     return false;
   }
 }
 function lineEndingState(root) {
-  const attributesPresent = (0, import_node_fs28.existsSync)((0, import_node_path25.join)(root, ".gitattributes"));
+  const attributesPresent = (0, import_node_fs29.existsSync)((0, import_node_path27.join)(root, ".gitattributes"));
   try {
     const output = execFileCapture("git", ["-C", root, "ls-files", "--eol", "--", ":(glob)**/*.sh"], {
       windowsHide: true
@@ -29277,102 +30630,6 @@ function registerExplainCommand(program3) {
   });
 }
 
-// src/file-lock.ts
-var import_promises3 = require("node:fs/promises");
-var import_node_path26 = require("node:path");
-var sleep = (ms) => new Promise((resolve6) => setTimeout(resolve6, ms));
-var IMMEDIATE_RETRY_BUDGET = 3;
-var FileLockBusyError = class extends Error {
-  lockPath;
-  constructor(label, lockPath, maxWaitMs) {
-    super(`${label} busy: ${lockPath} held longer than ${maxWaitMs}ms`);
-    this.name = "FileLockBusyError";
-    this.lockPath = lockPath;
-  }
-};
-function resolveFileLockOpts(opts = {}) {
-  return {
-    staleMs: opts.staleMs ?? 3e4,
-    retryMs: opts.retryMs ?? 50,
-    maxWaitMs: opts.maxWaitMs ?? 5e3,
-    label: opts.label ?? "file lock"
-  };
-}
-async function acquireFileLock(lockPath, opts, deadline) {
-  let immediateRetries = 0;
-  for (; ; ) {
-    let handle;
-    try {
-      handle = await (0, import_promises3.open)(lockPath, "wx");
-    } catch (e) {
-      const code = e.code;
-      if (code !== "EEXIST" && code !== "EPERM" && code !== "EBUSY" && code !== "EACCES") throw e;
-      const retryNow = async () => {
-        if (Date.now() >= deadline) throw new FileLockBusyError(opts.label, lockPath, opts.maxWaitMs);
-        if (++immediateRetries > IMMEDIATE_RETRY_BUDGET) await sleep(opts.retryMs);
-      };
-      try {
-        const age = Date.now() - (await (0, import_promises3.stat)(lockPath)).mtimeMs;
-        if (age > opts.staleMs) {
-          try {
-            await (0, import_promises3.unlink)(lockPath);
-            await retryNow();
-            continue;
-          } catch (unlinkError) {
-            if (unlinkError instanceof FileLockBusyError) throw unlinkError;
-            const unlinkCode = unlinkError.code;
-            if (unlinkCode === "ENOENT") {
-              await retryNow();
-              continue;
-            }
-          }
-        }
-      } catch (statError) {
-        if (statError instanceof FileLockBusyError) throw statError;
-        if (statError.code !== "ENOENT") throw statError;
-        await retryNow();
-        continue;
-      }
-      if (Date.now() >= deadline) {
-        throw new FileLockBusyError(opts.label, lockPath, opts.maxWaitMs);
-      }
-      await sleep(opts.retryMs);
-      continue;
-    }
-    const token = `${process.pid}-${Date.now()}-${Math.random().toString(36).slice(2)}`;
-    try {
-      await handle.writeFile(token);
-    } catch (e) {
-      await handle.close().catch(() => void 0);
-      throw e;
-    }
-    return { token, handle };
-  }
-}
-async function fileLockHeldBy(lockPath, token) {
-  try {
-    return await (0, import_promises3.readFile)(lockPath, "utf8") === token;
-  } catch {
-    return false;
-  }
-}
-async function releaseFileLock(lockPath, guard) {
-  await guard.handle.close().catch(() => void 0);
-  if (await fileLockHeldBy(lockPath, guard.token)) {
-    await (0, import_promises3.unlink)(lockPath).catch(() => void 0);
-  }
-}
-async function withFileLock(lockPath, opts, fn) {
-  const resolved = resolveFileLockOpts(opts);
-  await (0, import_promises3.mkdir)((0, import_node_path26.dirname)(lockPath), { recursive: true }).catch(() => void 0);
-  const guard = await acquireFileLock(lockPath, resolved, Date.now() + resolved.maxWaitMs);
-  try {
-    return await fn();
-  } finally {
-    await releaseFileLock(lockPath, guard);
-  }
-}
-
 // src/gh-account-visibility.ts
 function parseGhAuthAccounts(stdout) {
   const accounts = [];
@@ -29392,8 +30649,8 @@ function parseOriginRepo(remoteUrl) {
 }
 
 // src/issue-commands.ts
-var import_node_fs29 = require("node:fs");
-var import_node_crypto8 = require("node:crypto");
+var import_node_fs30 = require("node:fs");
+var import_node_crypto9 = require("node:crypto");
 
 // src/issue-body.ts
 var import_node_os15 = require("node:os");
@@ -29642,7 +30899,7 @@ async function editIssue(client, options, deps = {}) {
   const url = `https://github.com/${repo}/issues/${parsed.number}`;
   const patch = {};
   let bodyChanged = false;
-  const textDeps = () => deps.textDeps ?? { readFile: (p, e) => Promise.resolve((0, import_node_fs29.readFileSync)(p, e)), readStdin: () => Promise.resolve("") };
+  const textDeps = () => deps.textDeps ?? { readFile: (p, e) => Promise.resolve((0, import_node_fs30.readFileSync)(p, e)), readStdin: () => Promise.resolve("") };
   if (options.titleFile !== void 0) {
     patch.title = await resolveIssueTitle({ title: options.title, titleFile: options.titleFile }, textDeps());
   } else if (options.title !== void 0) {
@@ -29923,7 +31180,7 @@ function rowIdempotencyKey(batchKey, spec) {
   const identity = `${spec.type}
 ${spec.title.trim()}
 ${spec.body ?? ""}`;
-  const hash = (0, import_node_crypto8.createHash)("sha256").update(identity).digest("hex").slice(0, 16);
+  const hash = (0, import_node_crypto9.createHash)("sha256").update(identity).digest("hex").slice(0, 16);
   return `${batchKey}:${hash}`;
 }
 var BATCH_SPEC_KEYS = /* @__PURE__ */ new Set(["type", "title", "body", "priority", "labels", "label", "parent", "repo", "surface"]);
@@ -30243,8 +31500,8 @@ function registerIssueLifecycleCommands(program3, deps = {}) {
     (_opts, args) => ({ command: "issue unlink-child", parent: args[0], child: args[1] })
   ).action(async (parentRef, childRef, o) => {
     try {
-      parseIssueRef(parentRef, o.repo);
-      parseIssueRef(childRef, o.repo);
+      parseIssueRef(parentRef);
+      parseIssueRef(childRef);
       const defaultRepo = await resolveRepo(o.repo);
       const result = await unlinkSubIssue(ghRunner, parentRef, childRef, defaultRepo);
       console.log(JSON.stringify(result));
@@ -30267,7 +31524,7 @@ function extendCreateCommand(issue, batchAttach) {
     if (opts.batch) {
       let specs;
       try {
-        const raw = (0, import_node_fs29.readFileSync)(opts.batch, "utf8");
+        const raw = (0, import_node_fs30.readFileSync)(opts.batch, "utf8");
         specs = JSON.parse(raw);
         if (!Array.isArray(specs)) throw new Error("batch file must contain a JSON array");
       } catch (e) {
@@ -30739,7 +31996,7 @@ async function readRestPrSnapshotWithRetry(prNumber, repo, gh = defaultGhApi, op
   const retries = options?.retries ?? PR_SNAPSHOT_READ_RETRIES;
   const untilMs = options?.retryTransientUntilMs;
   const delayMs = options?.delayMs ?? (untilMs !== void 0 ? PR_CHECKS_POLL_MS : PR_SNAPSHOT_READ_DELAY_MS);
-  const sleep2 = options?.sleep ?? ((ms) => new Promise((resolve6) => setTimeout(resolve6, ms)));
+  const sleep2 = options?.sleep ?? ((ms) => new Promise((resolve7) => setTimeout(resolve7, ms)));
   const now = options?.now ?? (() => Date.now());
   let lastError = "no attempt completed";
   let attempt = 0;
@@ -31394,8 +32651,8 @@ function registerPrLifecycleCommands(program3) {
 }
 
 // src/project-info-sync.ts
-var import_node_fs30 = require("node:fs");
-var import_node_path27 = require("node:path");
+var import_node_fs31 = require("node:fs");
+var import_node_path28 = require("node:path");
 var UPDATE_PROJECT_INFO = `mutation($projectId: ID!, $shortDescription: String!, $readme: String!) {
   updateProjectV2(input: { projectId: $projectId, shortDescription: $shortDescription, readme: $readme }) {
     projectV2 { id }
@@ -31440,14 +32697,14 @@ function sharedName(entries, fallback) {
 }
 function buildProjectInfoSyncPlan(targetRepo2, project2, projects, repoRoot2) {
   if (!project2.projectId) throw new Error(`org project sync-info: ${targetRepo2} registry META has no projectId`);
-  const readmePath = (0, import_node_path27.join)(repoRoot2, "README.md");
-  if (!(0, import_node_fs30.existsSync)(readmePath)) throw new Error(`org project sync-info: ${targetRepo2} has no README.md`);
+  const readmePath = (0, import_node_path28.join)(repoRoot2, "README.md");
+  if (!(0, import_node_fs31.existsSync)(readmePath)) throw new Error(`org project sync-info: ${targetRepo2} has no README.md`);
   const entries = entriesFor(project2, projects);
   const memberRepos = [...new Set(entries.flatMap((entry) => entry.repos ?? []))].filter((repo) => /^[^/]+\/[^/]+$/.test(repo)).sort((a, b) => a.localeCompare(b));
   const projectName = sharedName(entries, project2.name?.trim() || targetRepo2.split("/").pop() || targetRepo2);
   if (!memberRepos.length) throw new Error(`org project sync-info: project ${projectName} has no registered member repos`);
   const entryNames = entries.map((entry) => entry.name?.trim()).filter((name) => Boolean(name));
-  const shortDescription = memberRepos.length === 1 ? shortDescriptionFromReadme((0, import_node_fs30.readFileSync)(readmePath, "utf8")) : `Shared work across ${new Intl.ListFormat("en", { type: "conjunction" }).format(entryNames)}.`;
+  const shortDescription = memberRepos.length === 1 ? shortDescriptionFromReadme((0, import_node_fs31.readFileSync)(readmePath, "utf8")) : `Shared work across ${new Intl.ListFormat("en", { type: "conjunction" }).format(entryNames)}.`;
   const lines = [
     `# ${projectName}`,
     "",
@@ -31466,8 +32723,8 @@ function buildProjectInfoSyncPlan(targetRepo2, project2, projects, repoRoot2) {
   const targetBase = `https://github.com/${targetRepo2}`;
   const targetBranch = branchFor(targetRepo2, projects);
   const orgDocs = [
-    (0, import_node_fs30.existsSync)((0, import_node_path27.join)(repoRoot2, "architecture.md")) ? `- [Hub architecture](${targetBase}/blob/${targetBranch}/architecture.md)` : "",
-    (0, import_node_fs30.existsSync)((0, import_node_path27.join)(repoRoot2, "docs", "Architecture", "agentic-dev-environment.md")) ? `- [Agentic development environment](${targetBase}/blob/${targetBranch}/docs/Architecture/agentic-dev-environment.md)` : ""
+    (0, import_node_fs31.existsSync)((0, import_node_path28.join)(repoRoot2, "architecture.md")) ? `- [Hub architecture](${targetBase}/blob/${targetBranch}/architecture.md)` : "",
+    (0, import_node_fs31.existsSync)((0, import_node_path28.join)(repoRoot2, "docs", "Architecture", "agentic-dev-environment.md")) ? `- [Agentic development environment](${targetBase}/blob/${targetBranch}/docs/Architecture/agentic-dev-environment.md)` : ""
   ].filter(Boolean);
   if (orgDocs.length) lines.push("", "## Organisation docs", "", ...orgDocs);
   return { projectId: project2.projectId, projectName, targetRepo: targetRepo2, memberRepos, shortDescription, readme: `${lines.join("\n")}
@@ -31682,7 +32939,7 @@ async function awsJson(args) {
   try {
     return await run();
   } catch {
-    await new Promise((resolve6) => setTimeout(resolve6, AWS_RETRY_DELAY_MS));
+    await new Promise((resolve7) => setTimeout(resolve7, AWS_RETRY_DELAY_MS));
     return run();
   }
 }
@@ -31885,8 +33142,8 @@ function registerSchedulesCommands(program3) {
 }
 
 // src/secrets-commands.ts
-var import_node_fs31 = require("node:fs");
-var import_node_path28 = require("node:path");
+var import_node_fs32 = require("node:fs");
+var import_node_path29 = require("node:path");
 var import_node_os16 = require("node:os");
 
 // src/secrets-diff.ts
@@ -31989,18 +33246,18 @@ function collectMap(value, previous = []) {
   return [...previous, value];
 }
 async function decryptRailsCredentials(input) {
-  const appDir = (0, import_node_path28.resolve)(input.appDir ?? process.cwd());
+  const appDir = (0, import_node_path29.resolve)(input.appDir ?? process.cwd());
   const credentialsFile = input.credentialsFile ?? DEFAULT_RAILS_CREDENTIALS_FILE;
   const masterKeyFile = input.masterKeyFile ?? DEFAULT_RAILS_MASTER_KEY_FILE;
-  const credentialsPath = (0, import_node_path28.resolve)(appDir, credentialsFile);
-  const masterKeyPath = (0, import_node_path28.resolve)(appDir, masterKeyFile);
+  const credentialsPath = (0, import_node_path29.resolve)(appDir, credentialsFile);
+  const masterKeyPath = (0, import_node_path29.resolve)(appDir, masterKeyFile);
   const env = {
     ...process.env,
     MMI_RAILS_CREDENTIALS_FILE: credentialsPath,
     MMI_RAILS_MASTER_KEY_FILE: masterKeyPath
   };
-  if ((0, import_node_fs31.existsSync)(masterKeyPath)) {
-    env.RAILS_MASTER_KEY = (0, import_node_fs31.readFileSync)(masterKeyPath, "utf8").trim();
+  if ((0, import_node_fs32.existsSync)(masterKeyPath)) {
+    env.RAILS_MASTER_KEY = (0, import_node_fs32.readFileSync)(masterKeyPath, "utf8").trim();
   }
   const script = [
     'require "json"',
@@ -32010,9 +33267,9 @@ async function decryptRailsCredentials(input) {
     'config = ActiveSupport::EncryptedConfiguration.new(config_path: config_path, key_path: key_path, env_key: "RAILS_MASTER_KEY", raise_if_missing_key: true)',
     "puts JSON.generate(config.config)"
   ].join("\n");
-  const scriptDir = (0, import_node_fs31.mkdtempSync)((0, import_node_path28.join)((0, import_node_os16.tmpdir)(), "mmi-rails-decrypt-"));
-  const scriptPath = (0, import_node_path28.join)(scriptDir, "decrypt.rb");
-  (0, import_node_fs31.writeFileSync)(scriptPath, script, "utf8");
+  const scriptDir = (0, import_node_fs32.mkdtempSync)((0, import_node_path29.join)((0, import_node_os16.tmpdir)(), "mmi-rails-decrypt-"));
+  const scriptPath = (0, import_node_path29.join)(scriptDir, "decrypt.rb");
+  (0, import_node_fs32.writeFileSync)(scriptPath, script, "utf8");
   try {
     const args = ["exec", "ruby", scriptPath];
     const cmd = process.platform === "win32" ? "cmd.exe" : "bundle";
@@ -32024,7 +33281,7 @@ async function decryptRailsCredentials(input) {
     });
     return JSON.parse(stdout);
   } finally {
-    (0, import_node_fs31.rmSync)(scriptDir, { recursive: true, force: true });
+    (0, import_node_fs32.rmSync)(scriptDir, { recursive: true, force: true });
   }
 }
 async function readSecretStdin() {
@@ -32114,7 +33371,7 @@ function registerSecretsCommands(program3) {
     let body;
     if (o.file) {
       try {
-        body = (0, import_node_fs31.readFileSync)((0, import_node_path28.resolve)(o.file), "utf8");
+        body = (0, import_node_fs32.readFileSync)((0, import_node_path29.resolve)(o.file), "utf8");
       } catch (e) {
         return fail(`secrets org-catalog: cannot read --file ${o.file}: ${e.message}`);
       }
@@ -32219,7 +33476,7 @@ function registerSecretsCommands(program3) {
       {
         ...d,
         decryptRailsCredentials,
-        removeFile: (path2) => (0, import_node_fs31.unlinkSync)((0, import_node_path28.resolve)(o.appDir ?? process.cwd(), path2))
+        removeFile: (path2) => (0, import_node_fs32.unlinkSync)((0, import_node_path29.resolve)(o.appDir ?? process.cwd(), path2))
       },
       {
         repo: o.repo,
@@ -32380,8 +33637,8 @@ function registerSessionReport(program3) {
 }
 
 // src/stage-commands.ts
-var import_node_fs32 = require("node:fs");
-var import_node_path29 = require("node:path");
+var import_node_fs33 = require("node:fs");
+var import_node_path30 = require("node:path");
 
 // src/stage-default.ts
 function shellFor(platform2 = process.platform) {
@@ -32665,8 +33922,8 @@ function registerStageCommands(program3) {
     return {
       resolution: decideStage({
         registry: { deployModel: project2?.deployModel, portRange, error: read.ok ? void 0 : read.error },
-        hasCompose: (0, import_node_fs32.existsSync)((0, import_node_path29.join)(process.cwd(), "docker-compose.yml")),
-        hasEnvExample: (0, import_node_fs32.existsSync)((0, import_node_path29.join)(process.cwd(), ".env.example")),
+        hasCompose: (0, import_node_fs33.existsSync)((0, import_node_path30.join)(process.cwd(), "docker-compose.yml")),
+        hasEnvExample: (0, import_node_fs33.existsSync)((0, import_node_path30.join)(process.cwd(), ".env.example")),
         repo
       }),
       project: project2,
@@ -32916,20 +34173,20 @@ function registerStageCommands(program3) {
 }
 
 // src/tenant-artifact.ts
-var import_node_crypto9 = require("node:crypto");
-var import_node_fs33 = require("node:fs");
+var import_node_crypto10 = require("node:crypto");
+var import_node_fs34 = require("node:fs");
 var import_promises6 = require("node:fs/promises");
-var import_node_path30 = require("node:path");
+var import_node_path31 = require("node:path");
 var ARTIFACT_ID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;
 var MAX_BYTES = 5 * 1024 * 1024 * 1024;
 async function sha256File(path2) {
-  const hash = (0, import_node_crypto9.createHash)("sha256");
-  for await (const chunk of (0, import_node_fs33.createReadStream)(path2)) hash.update(chunk);
+  const hash = (0, import_node_crypto10.createHash)("sha256");
+  for await (const chunk of (0, import_node_fs34.createReadStream)(path2)) hash.update(chunk);
   return hash.digest("hex");
 }
 async function putTenantArtifact(repo, stage, inputPath, deps) {
   if (!["dev", "rc", "main"].includes(stage)) throw new Error("tenant artifact put: <stage> must be dev, rc, or main");
-  const path2 = (0, import_node_path30.resolve)(inputPath);
+  const path2 = (0, import_node_path31.resolve)(inputPath);
   const info = await (0, import_promises6.stat)(path2);
   if (!info.isFile()) throw new Error("tenant artifact put: input path must be a file");
   if (!Number.isSafeInteger(info.size) || info.size < 1 || info.size > MAX_BYTES) throw new Error(`tenant artifact put: file must be 1..${MAX_BYTES} bytes`);
@@ -32947,7 +34204,7 @@ async function putTenantArtifact(repo, stage, inputPath, deps) {
     return [key, value];
   }));
   headers["content-length"] = String(info.size);
-  const stream = (0, import_node_fs33.createReadStream)(path2);
+  const stream = (0, import_node_fs34.createReadStream)(path2);
   let uploaded;
   try {
     uploaded = await fetch(body.uploadUrl, {
@@ -33087,7 +34344,7 @@ function renderVerifySecrets(body) {
 
 // src/command-register-collaboration.ts
 var import_node_child_process14 = require("node:child_process");
-var import_node_fs39 = require("node:fs");
+var import_node_fs41 = require("node:fs");
 var import_promises7 = require("node:fs/promises");
 
 // src/session-runtime.ts
@@ -33107,7 +34364,7 @@ function spawnDetachedSelf(args, deps, opts = {}) {
 }
 
 // src/command-register-collaboration.ts
-var import_node_path36 = require("node:path");
+var import_node_path38 = require("node:path");
 
 // src/attach-to-project.ts
 function boardAttachRateLimitedReceipt(resetEpochSeconds) {
@@ -33194,7 +34451,7 @@ async function mergeAutoWithTransientRetry(prNumber, repo, deps) {
   if (first.mergeStatus !== "failed") return first;
   const ready = await deps.probeMergeReady(prNumber, repo).catch(() => ({ open: false, mergeable: false, checksPassing: false }));
   if (!ready.open || !ready.mergeable || !ready.checksPassing) return first;
-  const sleep2 = deps.sleep ?? ((ms) => new Promise((resolve6) => setTimeout(resolve6, ms)));
+  const sleep2 = deps.sleep ?? ((ms) => new Promise((resolve7) => setTimeout(resolve7, ms)));
   await sleep2(PR_LAND_MERGE_RETRY_DELAY_MS);
   const retried = await deps.mergeAuto(prNumber, repo);
   if (retried.mergeStatus !== "failed") return retried;
@@ -33205,7 +34462,7 @@ var AUTO_MERGE_CONFIRM_DELAY_MS = 3e3;
 async function confirmAutoMergeEnqueued(deps, options) {
   const retries = options?.retries ?? AUTO_MERGE_CONFIRM_RETRIES;
   const delayMs = options?.delayMs ?? AUTO_MERGE_CONFIRM_DELAY_MS;
-  const sleep2 = deps.sleep ?? ((ms) => new Promise((resolve6) => setTimeout(resolve6, ms)));
+  const sleep2 = deps.sleep ?? ((ms) => new Promise((resolve7) => setTimeout(resolve7, ms)));
   for (let attempt = 0; attempt < retries; attempt++) {
     if (await deps.readMerged().catch(() => false)) return "merged";
     const stuck = await deps.readAutoMergeRequest().then((s) => s.trim()).catch(() => "");
@@ -33222,7 +34479,7 @@ async function confirmAutoMergeEnqueued(deps, options) {
 async function readGhPrStateWithRetry(fetchState, options) {
   const retries = options?.retries ?? PR_LAND_STATE_READ_RETRIES;
   const delayMs = options?.delayMs ?? PR_LAND_STATE_READ_DELAY_MS;
-  const sleep2 = options?.sleep ?? ((ms) => new Promise((resolve6) => setTimeout(resolve6, ms)));
+  const sleep2 = options?.sleep ?? ((ms) => new Promise((resolve7) => setTimeout(resolve7, ms)));
   let lastError = "empty state";
   for (let attempt = 0; attempt < retries; attempt++) {
     try {
@@ -33295,8 +34552,8 @@ async function runPrLand(prNumber, options, deps) {
 }
 
 // src/merge-cleanup.ts
-var import_node_fs35 = require("node:fs");
-var import_node_path32 = require("node:path");
+var import_node_fs36 = require("node:fs");
+var import_node_path33 = require("node:path");
 var import_node_os17 = require("node:os");
 
 // src/board-advance.ts
@@ -33399,8 +34656,8 @@ function boardAdvanceFailureMessage(result) {
 
 // src/test-policy-core.ts
 var import_node_child_process12 = require("node:child_process");
-var import_node_fs34 = require("node:fs");
-var import_node_path31 = require("node:path");
+var import_node_fs35 = require("node:fs");
+var import_node_path32 = require("node:path");
 
 // src/test-command-policy-shared.mjs
 var import_node_child_process11 = require("node:child_process");
@@ -33855,7 +35112,7 @@ function isMeaningfulRow(file) {
   return file.meaningful !== false;
 }
 function loadPolicy(root, readFile8 = readFileOrNull2) {
-  const raw = readFile8((0, import_node_path31.join)(root, POLICY_FILE));
+  const raw = readFile8((0, import_node_path32.join)(root, POLICY_FILE));
   if (raw == null) return { mandatory: [], declared: false };
   try {
     return { ...JSON.parse(raw), declared: true };
@@ -33865,7 +35122,7 @@ function loadPolicy(root, readFile8 = readFileOrNull2) {
 }
 function readFileOrNull2(path2) {
   try {
-    return (0, import_node_fs34.readFileSync)(path2, "utf8");
+    return (0, import_node_fs35.readFileSync)(path2, "utf8");
   } catch {
     return null;
   }
@@ -33893,12 +35150,12 @@ function classify(changed, policy, present = () => false) {
   const removedProtected = [...removed].filter((p) => protectedBy.has(p)).map((p) => ({ path: p, why: protectedBy.get(p) ?? "" }));
   return { mandatoryHits, untestedHits, testChanges, meaningfulTestChanges, addedTests, removedProtected };
 }
-function unresolvedProtectedEntries(policy, root, exists = (path2) => (0, import_node_fs34.existsSync)(path2)) {
-  return (policy.protected ?? []).map((p) => p.path).filter((p) => !exists((0, import_node_path31.join)(root, p)));
+function unresolvedProtectedEntries(policy, root, exists = (path2) => (0, import_node_fs35.existsSync)(path2)) {
+  return (policy.protected ?? []).map((p) => p.path).filter((p) => !exists((0, import_node_path32.join)(root, p)));
 }
-function unresolvedSatisfiers(policy, root, exists = (path2) => (0, import_node_fs34.existsSync)(path2)) {
+function unresolvedSatisfiers(policy, root, exists = (path2) => (0, import_node_fs35.existsSync)(path2)) {
   const declared = (policy.mandatory ?? []).flatMap((m) => m.satisfiedBy ?? []);
-  return [...new Set(declared)].filter((p) => !exists((0, import_node_path31.join)(root, p)));
+  return [...new Set(declared)].filter((p) => !exists((0, import_node_path32.join)(root, p)));
 }
 function evaluate(changed, policy, present = () => false) {
   const { mandatoryHits, untestedHits, meaningfulTestChanges, addedTests, removedProtected } = classify(changed, policy, present);
@@ -34026,17 +35283,17 @@ function blobAt(base, path2, cwd) {
 }
 function runTestPolicy(root, deps = {}) {
   const policy = deps.policy ?? loadPolicy(root);
-  const exists = deps.exists ?? ((path2) => (0, import_node_fs34.existsSync)(path2));
+  const exists = deps.exists ?? ((path2) => (0, import_node_fs35.existsSync)(path2));
   const counts = { mandatoryCount: (policy.mandatory ?? []).length, protectedCount: (policy.protected ?? []).length };
   const base = deps.changed ? "(injected)" : resolveBase(root, deps.base);
   const refusal = deps.changed ? null : untrustworthyRange(root, base);
   const raw = deps.changed ?? (refusal ? [] : changedFilesSince(base, root));
   const changed = deps.changed ? raw : annotateChangeMeaning(raw, policy, (path2) => ({
     before: blobAt(base, path2, root),
-    after: readFileOrNull2((0, import_node_path31.join)(root, path2))
+    after: readFileOrNull2((0, import_node_path32.join)(root, path2))
   }));
   const lookup = deps.override !== void 0 ? { override: deps.override, refusals: [] } : !deps.changed && !refusal ? readOverride2(base, root) : { override: null, refusals: [] };
-  const present = (path2) => exists((0, import_node_path31.join)(root, path2));
+  const present = (path2) => exists((0, import_node_path32.join)(root, path2));
   const removedByThisDiff = removedPaths(changed);
   const staleFindings = [];
   const unresolved = unresolvedProtectedEntries(policy, root, exists).filter((p) => !removedByThisDiff.has(p));
@@ -34236,13 +35493,13 @@ function resolveSquashMergeBodyText(commits, allowedClosing, cwd) {
   return rewritten === base ? null : rewritten;
 }
 function writeSquashBodyFile(body) {
-  const dir = (0, import_node_fs35.mkdtempSync)((0, import_node_path32.join)((0, import_node_os17.tmpdir)(), "mmi-squash-body-"));
-  const path2 = (0, import_node_path32.join)(dir, "body.txt");
-  (0, import_node_fs35.writeFileSync)(path2, body.endsWith("\n") ? body : `${body}
+  const dir = (0, import_node_fs36.mkdtempSync)((0, import_node_path33.join)((0, import_node_os17.tmpdir)(), "mmi-squash-body-"));
+  const path2 = (0, import_node_path33.join)(dir, "body.txt");
+  (0, import_node_fs36.writeFileSync)(path2, body.endsWith("\n") ? body : `${body}
 `, "utf8");
   return { path: path2, cleanup: () => {
     try {
-      (0, import_node_fs35.rmSync)(dir, { recursive: true, force: true });
+      (0, import_node_fs36.rmSync)(dir, { recursive: true, force: true });
     } catch {
     }
   } };
@@ -34444,8 +35701,8 @@ async function deleteMergedRemoteBranch(options) {
 }
 
 // src/post-merge-recon.ts
-var import_node_fs36 = require("node:fs");
-var import_node_path33 = require("node:path");
+var import_node_fs37 = require("node:fs");
+var import_node_path34 = require("node:path");
 
 // src/cross-repo-filing-issue.ts
 function crossRepoFilingRetryCommand(prRepo, prNumber) {
@@ -34611,16 +35868,16 @@ function buildPostMergeReconRecovery(input) {
 }
 function writePostMergeReconRecovery(cwd, recovery) {
   const path2 = postMergeReconStatePath(cwd, recovery.repo, recovery.pr);
-  (0, import_node_fs36.mkdirSync)((0, import_node_path33.dirname)(path2), { recursive: true });
-  (0, import_node_fs36.writeFileSync)(path2, `${JSON.stringify(recovery, null, 2)}
+  (0, import_node_fs37.mkdirSync)((0, import_node_path34.dirname)(path2), { recursive: true });
+  (0, import_node_fs37.writeFileSync)(path2, `${JSON.stringify(recovery, null, 2)}
 `, "utf8");
   return path2;
 }
 function clearPostMergeReconRecovery(cwd, repo, pr) {
   const path2 = postMergeReconStatePath(cwd, repo, pr);
-  if (!(0, import_node_fs36.existsSync)(path2)) return;
+  if (!(0, import_node_fs37.existsSync)(path2)) return;
   try {
-    (0, import_node_fs36.unlinkSync)(path2);
+    (0, import_node_fs37.unlinkSync)(path2);
   } catch {
   }
 }
@@ -34655,7 +35912,7 @@ var import_node_child_process13 = require("node:child_process");
 var GIT_TIMEOUT_MS2 = 15e3;
 function catFileBatch(root, ref, paths) {
   if (paths.length === 0) return Promise.resolve([]);
-  return new Promise((resolve6) => {
+  return new Promise((resolve7) => {
     const chunks = [];
     let settled = false;
     const child2 = (0, import_node_child_process13.spawn)("git", ["-C", root, "cat-file", "--batch", "--buffer"], { windowsHide: true });
@@ -34663,7 +35920,7 @@ function catFileBatch(root, ref, paths) {
       if (settled) return;
       settled = true;
       clearTimeout(timer);
-      resolve6(parseCatFileBatch(Buffer.concat(chunks), paths.length));
+      resolve7(parseCatFileBatch(Buffer.concat(chunks), paths.length));
     };
     const timer = setTimeout(() => {
       child2.kill("SIGKILL");
@@ -34772,12 +36029,69 @@ async function checkDocsIndexAtHead(opts, deps) {
 }
 
 // src/worktree-merge-cleanup.ts
+var import_node_fs40 = require("node:fs");
+var import_node_path37 = require("node:path");
+
+// src/jervcode-node-modules-cleanup.ts
 var import_node_fs38 = require("node:fs");
+var import_node_os18 = require("node:os");
 var import_node_path35 = require("node:path");
+var JERVCODE_PACKAGE_ENTRY = (0, import_node_path35.join)("node_modules", "@jervaise", "jervcode", "dist", "launcher-entry.js");
+var WIN_NAMES2 = ["jervcode.cmd", "jervcode"];
+var POSIX_NAMES2 = ["jervcode"];
+var NODE_MODULES_CLEANUP_TIMEOUT_MS = 3e5;
+function jervcodeCandidatePaths(env = process.env, home = (0, import_node_os18.homedir)(), platform2 = process.platform) {
+  const names = platform2 === "win32" ? WIN_NAMES2 : POSIX_NAMES2;
+  const out = [];
+  for (const dir of jervCliCandidateDirs(env, home, platform2)) {
+    for (const name of names) out.push((0, import_node_path35.join)(dir, name));
+  }
+  return out;
+}
+function resolveJervcodePath(env = process.env, home = (0, import_node_os18.homedir)(), platform2 = process.platform, exists = import_node_fs38.existsSync) {
+  for (const candidate of jervcodeCandidatePaths(env, home, platform2)) {
+    if (exists(candidate)) return candidate;
+  }
+  return void 0;
+}
+function jervcodeExecFileArgs(args, opts = {}) {
+  const platform2 = opts.platform ?? process.platform;
+  const exists = opts.exists ?? import_node_fs38.existsSync;
+  const resolved = resolveJervcodePath(opts.env ?? process.env, opts.home ?? (0, import_node_os18.homedir)(), platform2, exists);
+  if (resolved) {
+    const entry = (0, import_node_path35.join)((0, import_node_path35.join)(resolved, ".."), JERVCODE_PACKAGE_ENTRY);
+    if (exists(entry)) {
+      return { file: opts.execPath ?? process.execPath, args: [entry, ...args], via: "node-entry" };
+    }
+  }
+  const bin = resolved ?? "jervcode";
+  if (platform2 === "win32") {
+    return { file: "cmd.exe", args: ["/c", bin, ...args], via: resolved ? "cmd-shim" : "bare" };
+  }
+  return { file: bin, args: [...args], via: resolved ? "posix" : "bare" };
+}
+async function removeWorktreeNodeModulesViaHelper(wtPath, opts = {}) {
+  const { cwd, timeoutMs = NODE_MODULES_CLEANUP_TIMEOUT_MS } = opts;
+  const env = opts.env ?? process.env;
+  const exec = opts.exec ?? execFileP;
+  const candidates = jervcodeCandidatePaths(env, opts.home, opts.platform ?? process.platform);
+  const plan = jervcodeExecFileArgs(["worktree-node-modules-cleanup", "--worktree", wtPath], opts);
+  const execOptions = { timeout: timeoutMs, ...cwd ? { cwd } : {} };
+  try {
+    await exec(plan.file, plan.args, execOptions);
+    return { ok: true };
+  } catch (e) {
+    const err = e;
+    const base = formatJervCliSpawnFailure(err, plan, candidates);
+    const stderr = typeof err.stderr === "string" ? err.stderr.trim() : "";
+    const detail = stderr.split("\n")[0] || base;
+    return { ok: false, error: `jervcode worktree-node-modules-cleanup failed: ${detail}` };
+  }
+}
 
 // src/worktree-evidence-archive.ts
-var import_node_fs37 = require("node:fs");
-var import_node_path34 = require("node:path");
+var import_node_fs39 = require("node:fs");
+var import_node_path36 = require("node:path");
 var JERV_ARTIFACT_RUN_SCOPE_ENV_VARS = ["JERV_RUN_ID", ...SESSION_ID_ENV_VARS];
 function sanitizeArchiveSegment(value, max = 80) {
   const scrubbed = value.replace(/[^A-Za-z0-9._@+-]+/g, "-").replace(/^-+|-+$/g, "");
@@ -34792,24 +36106,24 @@ function resolveArtifactRunScope(env = process.env) {
 }
 function defaultIsDirectory(path2) {
   try {
-    return (0, import_node_fs37.lstatSync)(path2).isDirectory();
+    return (0, import_node_fs39.lstatSync)(path2).isDirectory();
   } catch {
     return false;
   }
 }
 function archiveWorktreeJervArtifacts(args, deps = {}) {
-  const exists = deps.exists ?? import_node_fs37.existsSync;
+  const exists = deps.exists ?? import_node_fs39.existsSync;
   const isDirectory = deps.isDirectory ?? defaultIsDirectory;
-  const copyDir = deps.copyDir ?? ((from, to) => (0, import_node_fs37.cpSync)(from, to, { recursive: true, force: true }));
+  const copyDir = deps.copyDir ?? ((from, to) => (0, import_node_fs39.cpSync)(from, to, { recursive: true, force: true }));
   const mkdirp = deps.mkdirp ?? ((path2) => {
-    (0, import_node_fs37.mkdirSync)(path2, { recursive: true });
+    (0, import_node_fs39.mkdirSync)(path2, { recursive: true });
   });
   const env = deps.env ?? process.env;
   const now = deps.now ?? (() => /* @__PURE__ */ new Date());
   const resolveRoot = deps.resolveArchiveRoot ?? repoRuntimeStatePath;
   if (!args.primaryRoot?.trim()) return { status: "skipped", reason: "missing-primary-root" };
   if (!args.worktreePath?.trim()) return { status: "skipped", reason: "missing-worktree-path" };
-  const source = (0, import_node_path34.join)(args.worktreePath, ".jerv");
+  const source = (0, import_node_path36.join)(args.worktreePath, ".jerv");
   if (!exists(source)) return { status: "absent" };
   if (!isDirectory(source)) return { status: "skipped", reason: "jerv-not-a-directory" };
   const runScope = resolveArtifactRunScope(env);
@@ -34817,7 +36131,7 @@ function archiveWorktreeJervArtifacts(args, deps = {}) {
   const stamp = now().toISOString().replace(/[:.]/g, "-");
   const dest = resolveRoot(args.primaryRoot, "jerv-artifacts", runScope, branchSlug, stamp, ".jerv");
   try {
-    mkdirp((0, import_node_path34.dirname)(dest));
+    mkdirp((0, import_node_path36.dirname)(dest));
     copyDir(source, dest);
     if (!exists(dest)) return { status: "failed", error: `archive write left no directory at ${dest}` };
     return { status: "archived", path: dest, runScope };
@@ -34826,14 +36140,14 @@ function archiveWorktreeJervArtifacts(args, deps = {}) {
   }
 }
 function defaultStat(path2) {
-  const st = (0, import_node_fs37.statSync)(path2);
+  const st = (0, import_node_fs39.statSync)(path2);
   return { mtimeMs: st.mtimeMs, size: st.size, isDirectory: () => st.isDirectory() };
 }
 function scanWorktreeTmpEvidence(worktreePath, newerThanMs, deps = {}) {
-  const exists = deps.exists ?? import_node_fs37.existsSync;
+  const exists = deps.exists ?? import_node_fs39.existsSync;
   const stat4 = deps.stat ?? defaultStat;
-  const readdir2 = deps.readdir ?? import_node_fs37.readdirSync;
-  const tmpRoot = (0, import_node_path34.join)(worktreePath, "tmp");
+  const readdir2 = deps.readdir ?? import_node_fs39.readdirSync;
+  const tmpRoot = (0, import_node_path36.join)(worktreePath, "tmp");
   if (!exists(tmpRoot)) return [];
   const entries = [];
   const walk2 = (dir) => {
@@ -34844,14 +36158,14 @@ function scanWorktreeTmpEvidence(worktreePath, newerThanMs, deps = {}) {
       return;
     }
     for (const name of names) {
-      const full = (0, import_node_path34.join)(dir, name);
+      const full = (0, import_node_path36.join)(dir, name);
       let st;
       try {
         st = stat4(full);
       } catch {
         continue;
       }
-      const relPath = (0, import_node_path34.relative)(worktreePath, full).replace(/\\/g, "/");
+      const relPath = (0, import_node_path36.relative)(worktreePath, full).replace(/\\/g, "/");
       if (st.isDirectory()) {
         if (st.mtimeMs > newerThanMs) entries.push({ relPath, bytes: 0, mtimeMs: st.mtimeMs });
         walk2(full);
@@ -34865,10 +36179,10 @@ function scanWorktreeTmpEvidence(worktreePath, newerThanMs, deps = {}) {
   return entries;
 }
 function archiveWorktreeTmpArtifacts(args, deps = {}) {
-  const exists = deps.exists ?? import_node_fs37.existsSync;
-  const copyDir = deps.copyDir ?? ((from, to) => (0, import_node_fs37.cpSync)(from, to, { recursive: true, force: true }));
+  const exists = deps.exists ?? import_node_fs39.existsSync;
+  const copyDir = deps.copyDir ?? ((from, to) => (0, import_node_fs39.cpSync)(from, to, { recursive: true, force: true }));
   const mkdirp = deps.mkdirp ?? ((path2) => {
-    (0, import_node_fs37.mkdirSync)(path2, { recursive: true });
+    (0, import_node_fs39.mkdirSync)(path2, { recursive: true });
   });
   const env = deps.env ?? process.env;
   const now = deps.now ?? (() => /* @__PURE__ */ new Date());
@@ -34876,7 +36190,7 @@ function archiveWorktreeTmpArtifacts(args, deps = {}) {
   if (!args.primaryRoot?.trim()) return { status: "skipped", reason: "missing-primary-root" };
   if (!args.worktreePath?.trim()) return { status: "skipped", reason: "missing-worktree-path" };
   const scanned = scanWorktreeTmpEvidence(args.worktreePath, args.newerThanMs, deps);
-  const source = (0, import_node_path34.join)(args.worktreePath, "tmp");
+  const source = (0, import_node_path36.join)(args.worktreePath, "tmp");
   if (!scanned.length) return { status: "absent" };
   if (!exists(source)) return { status: "absent" };
   const runScope = resolveArtifactRunScope(env);
@@ -34884,7 +36198,7 @@ function archiveWorktreeTmpArtifacts(args, deps = {}) {
   const stamp = now().toISOString().replace(/[:.]/g, "-");
   const dest = resolveRoot(args.primaryRoot, "worktree-artifacts", runScope, branchSlug, stamp, "tmp");
   try {
-    mkdirp((0, import_node_path34.dirname)(dest));
+    mkdirp((0, import_node_path36.dirname)(dest));
     copyDir(source, dest);
     if (!exists(dest)) return { status: "failed", error: `archive write left no directory at ${dest}` };
     const bytes = scanned.reduce((sum, e) => sum + e.bytes, 0);
@@ -34953,9 +36267,9 @@ function normPath2(p) {
   return p.replace(/\\/g, "/").replace(/\/+$/, "");
 }
 function unlinkNodeModulesJunction(wtPath) {
-  const nm = (0, import_node_path35.join)(wtPath, "node_modules");
+  const nm = (0, import_node_path37.join)(wtPath, "node_modules");
   try {
-    if ((0, import_node_fs38.lstatSync)(nm).isSymbolicLink()) (0, import_node_fs38.rmdirSync)(nm);
+    if ((0, import_node_fs40.lstatSync)(nm).isSymbolicLink()) (0, import_node_fs40.rmdirSync)(nm);
     return { ok: true };
   } catch (e) {
     if (e.code === "ENOENT") return { ok: true };
@@ -34963,11 +36277,11 @@ function unlinkNodeModulesJunction(wtPath) {
   }
 }
 function defaultSleep2(ms) {
-  return new Promise((resolve6) => setTimeout(resolve6, ms));
+  return new Promise((resolve7) => setTimeout(resolve7, ms));
 }
 async function removeResidueDirectory(wtPath, options = {}) {
-  const { sleep: sleep2 = defaultSleep2, removeEmptyDir = import_node_fs38.rmdirSync, exists = import_node_fs38.existsSync } = options;
-  const removeRecursive = options.removeRecursive ?? ((path2) => (0, import_node_fs38.rmSync)(path2, { recursive: true, force: true, maxRetries: 10, retryDelay: 100 }));
+  const { sleep: sleep2 = defaultSleep2, removeEmptyDir = import_node_fs40.rmdirSync, exists = import_node_fs40.existsSync } = options;
+  const removeRecursive = options.removeRecursive ?? ((path2) => (0, import_node_fs40.rmSync)(path2, { recursive: true, force: true, maxRetries: 10, retryDelay: 100 }));
   const junction = unlinkNodeModulesJunction(wtPath);
   if (!junction.ok) return junction;
   try {
@@ -35181,7 +36495,7 @@ async function cleanupPrMergeLocalBranch(branch, options) {
     return report;
   }
   const execGit = options.execGit ?? (async (args) => (await execFileP("git", args, { timeout: GIT_TIMEOUT_MS })).stdout);
-  const pathExists = options.pathExists ?? import_node_fs38.existsSync;
+  const pathExists = options.pathExists ?? import_node_fs40.existsSync;
   let afterWorktrees = [];
   try {
     afterWorktrees = parseGitWorktreePorcelain(await execGit(["worktree", "list", "--porcelain"]));
@@ -35273,6 +36587,23 @@ async function cleanupPrMergeLocalBranch(branch, options) {
     report.localBranch = { name: branch, status: "not-attempted", reason: "archive-failed" };
     return report;
   }
+  if (pathExists((0, import_node_path37.join)(wtPath, "node_modules"))) {
+    const nmRemoved = await (options.removeRealNodeModules ?? ((p) => removeWorktreeNodeModulesViaHelper(p, { cwd: mainWorktreePath })))(wtPath);
+    if (!nmRemoved.ok) {
+      report.worktree = {
+        path: wtPath,
+        status: "failed",
+        reason: "pre-clean-failed",
+        error: `real-node_modules cleanup failed before worktree removal: ${nmRemoved.error}`,
+        artifactsArchive,
+        stageTeardown,
+        tmpEvidenceCount: tmpEvidence.length,
+        remediation: `jervcode worktree-node-modules-cleanup --worktree '${wtPath.replace(/'/g, "''")}'`
+      };
+      report.localBranch = { name: branch, status: "not-attempted", reason: "worktree-pre-clean-failed" };
+      return report;
+    }
+  }
   const preClean = await preCleanWorktreeForRemoval(wtPath, execGit);
   if (!preClean.ok) {
     report.worktree = {
@@ -35399,10 +36730,10 @@ function argvWantsJson2() {
   return process.argv.some((a) => a === "--json" || a.startsWith("--json="));
 }
 function hubRoot() {
-  const fromPkg = (0, import_node_path36.join)(__dirname, "..", "..");
+  const fromPkg = (0, import_node_path38.join)(__dirname, "..", "..");
   const marker = "skills/bootstrap/seeds/manifest.json";
-  if ((0, import_node_fs39.existsSync)((0, import_node_path36.join)(fromPkg, marker))) return fromPkg;
-  if ((0, import_node_fs39.existsSync)((0, import_node_path36.join)(process.cwd(), marker))) return process.cwd();
+  if ((0, import_node_fs41.existsSync)((0, import_node_path38.join)(fromPkg, marker))) return fromPkg;
+  if ((0, import_node_fs41.existsSync)((0, import_node_path38.join)(process.cwd(), marker))) return process.cwd();
   return null;
 }
 function ciAuditDeps() {
@@ -35414,8 +36745,8 @@ function ciAuditDeps() {
     getProjectMeta: async (slug) => fetchProjectBySlug(slug, registryClientDeps(await cfgPromise)),
     readSeedFile: (path2) => {
       if (!root) return null;
-      const fullPath = (0, import_node_path36.join)(root, path2);
-      return (0, import_node_fs39.existsSync)(fullPath) ? (0, import_node_fs39.readFileSync)(fullPath, "utf8") : null;
+      const fullPath = (0, import_node_path38.join)(root, path2);
+      return (0, import_node_fs41.existsSync)(fullPath) ? (0, import_node_fs41.readFileSync)(fullPath, "utf8") : null;
     }
   };
 }
@@ -35631,7 +36962,7 @@ function registerCollaborationCommands(program3) {
         repo: targetRepo2,
         labels: extraLabels.length ? extraLabels : void 0
       });
-      if (o.parent !== void 0) parseIssueRef(o.parent, o.repo);
+      if (o.parent !== void 0) parseIssueRef(o.parent);
     } catch (e) {
       return fail(`issue create: ${e.message}`, e instanceof TextArgError ? { code: e.code, offending_flag: e.offendingFlag } : void 0);
     }
@@ -35788,14 +37119,14 @@ function registerCollaborationCommands(program3) {
   jsonParity(issue.command("link-child <parent> <child>").description("link an existing issue as a native sub-issue of a parent and print {parentNumber,subIssueNumber,totalCount} JSON").option("--repo <owner/repo>", "repo for bare refs on either side (defaults to the current repo)")).action(async (parentRef, childRef, o) => {
     const defaultRepo = await resolveRepo(o.repo);
     try {
-      parseIssueRef(parentRef, o.repo);
-      parseIssueRef(childRef, o.repo);
+      parseIssueRef(parentRef);
+      parseIssueRef(childRef);
       const result = await linkSubIssue(ghRunner2, parentRef, childRef, defaultRepo);
       console.log(JSON.stringify(result));
     } catch (e) {
       let conflict;
       try {
-        const child2 = parseIssueRef(childRef, o.repo);
+        const child2 = parseIssueRef(childRef);
         const childRepo = child2.repo ?? defaultRepo;
         if (childRepo) conflict = await classifyReparentFailure(e, ghRunner2, childRepo, child2.number, parentRef);
       } catch {
@@ -36046,11 +37377,11 @@ ${list}`);
     }
   });
   async function listCiWorkflowPaths(cwd = process.cwd()) {
-    const wfDir = (0, import_node_path36.join)(cwd, ".github", "workflows");
-    if (!(0, import_node_fs39.existsSync)(wfDir)) return [];
-    return (0, import_node_fs39.readdirSync)(wfDir).filter((name) => /\.(ya?ml)$/i.test(name)).filter((name) => {
+    const wfDir = (0, import_node_path38.join)(cwd, ".github", "workflows");
+    if (!(0, import_node_fs41.existsSync)(wfDir)) return [];
+    return (0, import_node_fs41.readdirSync)(wfDir).filter((name) => /\.(ya?ml)$/i.test(name)).filter((name) => {
       try {
-        return workflowReportsPrChecks((0, import_node_fs39.readFileSync)((0, import_node_path36.join)(wfDir, name), "utf8"));
+        return workflowReportsPrChecks((0, import_node_fs41.readFileSync)((0, import_node_path38.join)(wfDir, name), "utf8"));
       } catch {
         return true;
       }
@@ -36208,7 +37539,7 @@ ${list}`);
       // #5400: after grace, name "GitHub delivered zero runs" instead of burning the full budget as pending.
       pollHeadWorkflowRunCount: () => waitLoopHeadWorkflowRunCount("pr checks-wait", number, repo),
       baseBranch,
-      sleep: (ms) => new Promise((resolve6) => setTimeout(resolve6, ms)),
+      sleep: (ms) => new Promise((resolve7) => setTimeout(resolve7, ms)),
       log: (message) => console.warn(message),
       timeoutMs: Math.max(1, budgetMs - (Date.now() - waitStarted)),
       // Liveness on stderr, one line per poll. A silent bounded wait is indistinguishable from a hang, and
@@ -36312,7 +37643,7 @@ ${list}`);
           // #5400: same zero-runs delivery probe as checks-wait — do not burn the land budget on silence.
           pollHeadWorkflowRunCount: () => waitLoopHeadWorkflowRunCount("pr land", prNumber, repo),
           baseBranch: "development",
-          sleep: (ms) => new Promise((resolve6) => setTimeout(resolve6, ms)),
+          sleep: (ms) => new Promise((resolve7) => setTimeout(resolve7, ms)),
           log: (message) => console.warn(message),
           // `pr land` inherits the same (raised) checks budget, so it needs the same liveness — otherwise the
           // 30m wait is SILENT and reads exactly like the hang #2940 was filed about, only three times longer.
@@ -36358,7 +37689,7 @@ ${list}`);
           } else {
             lastFailure = void 0;
           }
-          await new Promise((resolve6) => setTimeout(resolve6, PR_LAND_POLL_MS));
+          await new Promise((resolve7) => setTimeout(resolve7, PR_LAND_POLL_MS));
         }
         if (lastFailure) {
           throw new Error(
@@ -36445,7 +37776,7 @@ ${list}`);
     const mergeSquashBody = squashBodyTextForMerge(
       closingGuardInput,
       method === "--squash",
-      o.squashBodyFile ? (0, import_node_fs39.readFileSync)(o.squashBodyFile, "utf8") : void 0
+      o.squashBodyFile ? (0, import_node_fs41.readFileSync)(o.squashBodyFile, "utf8") : void 0
     );
     if (!o.squashBodyFile) warnSquashBodyClosingStrip("pr merge", closingGuardInput, mergeSquashBody);
     const closingGuardVerdict = evaluateClosingGuard(closingGuardInput, {
@@ -36495,7 +37826,7 @@ ${list}`);
         checksDiagnosticCommand: `gh pr checks ${number} --repo ${repo}`,
         pollHeadWorkflowRunCount: () => waitLoopHeadWorkflowRunCount("pr merge --wait", number, repo),
         baseBranch,
-        sleep: (ms) => new Promise((resolve6) => setTimeout(resolve6, ms)),
+        sleep: (ms) => new Promise((resolve7) => setTimeout(resolve7, ms)),
         log: (message) => console.warn(message),
         timeoutMs: Math.max(1, budgetMs - (Date.now() - waitStarted)),
         progress: ({ state, elapsedMs, remainingMs }) => console.warn(`pr merge: --wait checks \u2014 ${state}, ${Math.round(elapsedMs / 1e3)}s elapsed, ${Math.round(remainingMs / 6e4)}m left`)
@@ -36549,7 +37880,7 @@ ${list}`);
           }
           if (!repoForPostCleanup) throw e;
           console.warn(`pr merge: gh GraphQL rate-limited \u2014 merging PR #${number} via REST PUT instead (#4588).`);
-          const commitMessage = bodyFile ? (0, import_node_fs39.readFileSync)(bodyFile, "utf8") : void 0;
+          const commitMessage = bodyFile ? (0, import_node_fs41.readFileSync)(bodyFile, "utf8") : void 0;
           await defaultGitHubClient().rest("PUT", `repos/${repoForPostCleanup}/pulls/${number}/merge`, {
             body: { merge_method: method.slice(2), ...commitMessage ? { commit_message: commitMessage } : {} },
             timeoutMs: GH_MUTATION_TIMEOUT_MS
@@ -36637,7 +37968,7 @@ ${list}`);
         preserveWorktree: o.preserveWorktree,
         gcAcknowledged: o.gc,
         expectedHeadOid: headRefOid,
-        pathExists: (p) => (0, import_node_fs39.existsSync)(p),
+        pathExists: (p) => (0, import_node_fs41.existsSync)(p),
         // #5899: pin cleanup git calls to the main checkout — the task worktree this process may be
         // standing in is removed mid-cleanup, so a cwd-relative invocation fails with
         // 'fatal: not a git repository' and leaves a spurious partial-cleanup exit.
@@ -36752,7 +38083,7 @@ ${list}`);
 }
 
 // src/command-register-developer.ts
-var import_node_fs44 = require("node:fs");
+var import_node_fs46 = require("node:fs");
 
 // src/whoami.ts
 async function resolveWhoami(deps) {
@@ -36782,7 +38113,7 @@ async function resolveWhoami(deps) {
 }
 
 // src/command-register-developer.ts
-var import_node_path41 = require("node:path");
+var import_node_path43 = require("node:path");
 
 // src/wave-land.ts
 function planWaveLand(prs) {
@@ -36813,7 +38144,7 @@ async function executeWaveLand(plan, deps) {
 }
 
 // src/box-commands.ts
-var import_node_fs40 = require("node:fs");
+var import_node_fs42 = require("node:fs");
 
 // src/box.ts
 var BOX_KEYS = {
@@ -37016,7 +38347,7 @@ function registerBoxCommands(program3) {
       }
       if (o.json) console.log(JSON.stringify({ box: found, incomplete }, null, 2));
       else if (o.ssh && o.script) {
-        (0, import_node_fs40.writeFileSync)(o.script, sshRecipeScript(found), "utf8");
+        (0, import_node_fs42.writeFileSync)(o.script, sshRecipeScript(found), "utf8");
         console.log(`wrote ${o.script} \u2014 run: bash "${o.script}"`);
       } else if (o.ssh) console.log(`${formatSshRecipe(found)}
 ${SSH_RECIPE_AGENT_NOTE}`);
@@ -37031,28 +38362,28 @@ ${SSH_RECIPE_AGENT_NOTE}`);
 
 // src/dist-drift.ts
 var import_node_child_process15 = require("node:child_process");
-var import_node_crypto11 = require("node:crypto");
-var import_node_fs42 = require("node:fs");
-var import_node_os18 = require("node:os");
-var import_node_path38 = require("node:path");
+var import_node_crypto12 = require("node:crypto");
+var import_node_fs44 = require("node:fs");
+var import_node_os19 = require("node:os");
+var import_node_path40 = require("node:path");
 
 // ../scripts/distribution-digest.mjs
-var import_node_crypto10 = require("node:crypto");
-var import_node_fs41 = require("node:fs");
-var import_node_path37 = require("node:path");
+var import_node_crypto11 = require("node:crypto");
+var import_node_fs43 = require("node:fs");
+var import_node_path39 = require("node:path");
 var slash = (value) => value.replaceAll("\\", "/");
 function repoPath(root, declaredPath, label) {
-  const absoluteRoot = (0, import_node_path37.resolve)(root);
-  const target = (0, import_node_path37.resolve)(root, declaredPath);
-  if (target !== absoluteRoot && !target.startsWith(`${absoluteRoot}${import_node_path37.sep}`)) {
+  const absoluteRoot = (0, import_node_path39.resolve)(root);
+  const target = (0, import_node_path39.resolve)(root, declaredPath);
+  if (target !== absoluteRoot && !target.startsWith(`${absoluteRoot}${import_node_path39.sep}`)) {
     throw new Error(`${label} ${declaredPath} escapes the repository root`);
   }
   return target;
 }
 function digestFiles(files) {
-  const hash = (0, import_node_crypto10.createHash)("sha256");
+  const hash = (0, import_node_crypto11.createHash)("sha256");
   for (const file of [...files].sort((a, b) => a.relative.localeCompare(b.relative))) {
-    const content = file.stat.isSymbolicLink() ? Buffer.from((0, import_node_fs41.readlinkSync)(file.absolute), "utf8") : (0, import_node_fs41.readFileSync)(file.absolute);
+    const content = file.stat.isSymbolicLink() ? Buffer.from((0, import_node_fs43.readlinkSync)(file.absolute), "utf8") : (0, import_node_fs43.readFileSync)(file.absolute);
     hash.update(file.relative, "utf8");
     hash.update("\0");
     hash.update(file.stat.isSymbolicLink() ? "symlink" : "file", "utf8");
@@ -37067,8 +38398,8 @@ function digestFiles(files) {
 function digestPackedFiles(packageRoot, packedFiles) {
   return digestFiles(packedFiles.map((path2) => {
     const absolute = repoPath(packageRoot, path2, "packed artifact identity path");
-    if (!(0, import_node_fs41.existsSync)(absolute)) throw new Error(`packed artifact identity path ${path2} does not exist`);
-    return { absolute, relative: slash(path2), stat: (0, import_node_fs41.lstatSync)(absolute) };
+    if (!(0, import_node_fs43.existsSync)(absolute)) throw new Error(`packed artifact identity path ${path2} does not exist`);
+    return { absolute, relative: slash(path2), stat: (0, import_node_fs43.lstatSync)(absolute) };
   }));
 }
 
@@ -37080,7 +38411,7 @@ var DIST_ARTIFACTS = [
 ];
 var BOM_DIST_TREE_ID = "mmi-cli-dist";
 var ABSENT = "absent";
-var sha256 = (bytes) => `sha256:${(0, import_node_crypto11.createHash)("sha256").update(bytes).digest("hex")}`;
+var sha256 = (bytes) => `sha256:${(0, import_node_crypto12.createHash)("sha256").update(bytes).digest("hex")}`;
 function artifactDrift(path2, committedBytes, rebuiltBytes) {
   const committed = committedBytes ? sha256(committedBytes) : ABSENT;
   const rebuiltExpected = rebuiltBytes ? sha256(rebuiltBytes) : ABSENT;
@@ -37152,13 +38483,13 @@ function renderDistDriftReceipt(receipt) {
   return lines;
 }
 function readOrNull(path2) {
-  return (0, import_node_fs42.existsSync)(path2) ? (0, import_node_fs42.readFileSync)(path2) : null;
+  return (0, import_node_fs44.existsSync)(path2) ? (0, import_node_fs44.readFileSync)(path2) : null;
 }
 function walkFiles(root) {
   const files = [];
   const walk2 = (directory) => {
-    for (const entry of (0, import_node_fs42.readdirSync)(directory, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name))) {
-      const child2 = (0, import_node_path38.join)(directory, entry.name);
+    for (const entry of (0, import_node_fs44.readdirSync)(directory, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name))) {
+      const child2 = (0, import_node_path40.join)(directory, entry.name);
       if (entry.isDirectory()) walk2(child2);
       else files.push(child2);
     }
@@ -37168,10 +38499,10 @@ function walkFiles(root) {
 }
 function bomPathFor(root) {
   try {
-    const registry2 = JSON.parse((0, import_node_fs42.readFileSync)((0, import_node_path38.join)(root, "surfaces.json"), "utf8"));
-    return (0, import_node_path38.join)(root, registry2?.sharedAgentCore?.releaseMetadata?.bomPath ?? "distribution-bom.json");
+    const registry2 = JSON.parse((0, import_node_fs44.readFileSync)((0, import_node_path40.join)(root, "surfaces.json"), "utf8"));
+    return (0, import_node_path40.join)(root, registry2?.sharedAgentCore?.releaseMetadata?.bomPath ?? "distribution-bom.json");
   } catch {
-    return (0, import_node_path38.join)(root, "distribution-bom.json");
+    return (0, import_node_path40.join)(root, "distribution-bom.json");
   }
 }
 function rebuildTo(packageRoot, outDir) {
@@ -37184,35 +38515,35 @@ function rebuildTo(packageRoot, outDir) {
   });
 }
 function runDistStatus(root) {
-  const stage = (0, import_node_fs42.mkdtempSync)((0, import_node_path38.join)((0, import_node_os18.tmpdir)(), "mmi-dist-drift-"));
+  const stage = (0, import_node_fs44.mkdtempSync)((0, import_node_path40.join)((0, import_node_os19.tmpdir)(), "mmi-dist-drift-"));
   let overlayCount = 0;
   try {
-    const cliOut = (0, import_node_path38.join)(stage, "cli-dist");
-    const hubOut = (0, import_node_path38.join)(stage, "hub-dist");
-    rebuildTo((0, import_node_path38.join)(root, "cli"), cliOut);
-    rebuildTo((0, import_node_path38.join)(root, "updater"), hubOut);
+    const cliOut = (0, import_node_path40.join)(stage, "cli-dist");
+    const hubOut = (0, import_node_path40.join)(stage, "hub-dist");
+    rebuildTo((0, import_node_path40.join)(root, "cli"), cliOut);
+    rebuildTo((0, import_node_path40.join)(root, "updater"), hubOut);
     const outDirFor = (packageDir) => packageDir === "cli" ? cliOut : hubOut;
     const rebuilt = (path2) => {
       const spec = DIST_ARTIFACTS.find((entry) => entry.path === path2);
-      return spec ? readOrNull((0, import_node_path38.join)(outDirFor(spec.packageDir), spec.output)) : null;
+      return spec ? readOrNull((0, import_node_path40.join)(outDirFor(spec.packageDir), spec.output)) : null;
     };
-    const committed = (path2) => readOrNull((0, import_node_path38.join)(root, path2));
-    const tree = (path2) => readOrNull((0, import_node_path38.join)(root, path2));
-    const distRoot = (0, import_node_path38.join)(root, "cli", "dist");
-    const distTree = () => walkFiles(distRoot).map((absolute) => `cli/dist/${(0, import_node_path38.relative)(distRoot, absolute).replaceAll("\\", "/")}`);
-    const bom = JSON.parse((0, import_node_fs42.readFileSync)(bomPathFor(root), "utf8"));
+    const committed = (path2) => readOrNull((0, import_node_path40.join)(root, path2));
+    const tree = (path2) => readOrNull((0, import_node_path40.join)(root, path2));
+    const distRoot = (0, import_node_path40.join)(root, "cli", "dist");
+    const distTree = () => walkFiles(distRoot).map((absolute) => `cli/dist/${(0, import_node_path40.relative)(distRoot, absolute).replaceAll("\\", "/")}`);
+    const bom = JSON.parse((0, import_node_fs44.readFileSync)(bomPathFor(root), "utf8"));
     const digest = (entries) => {
-      const overlay = (0, import_node_path38.join)(stage, `overlay-${overlayCount++}`);
+      const overlay = (0, import_node_path40.join)(stage, `overlay-${overlayCount++}`);
       for (const entry of entries) {
-        const target = (0, import_node_path38.join)(overlay, entry.path);
-        (0, import_node_fs42.mkdirSync)((0, import_node_path38.dirname)(target), { recursive: true });
-        (0, import_node_fs42.writeFileSync)(target, entry.bytes);
+        const target = (0, import_node_path40.join)(overlay, entry.path);
+        (0, import_node_fs44.mkdirSync)((0, import_node_path40.dirname)(target), { recursive: true });
+        (0, import_node_fs44.writeFileSync)(target, entry.bytes);
       }
       return digestPackedFiles(overlay, entries.map((entry) => entry.path));
     };
     return computeDistDriftReceipt({ committed, tree, rebuilt, distTree, bom, digest });
   } finally {
-    (0, import_node_fs42.rmSync)(stage, { recursive: true, force: true });
+    (0, import_node_fs44.rmSync)(stage, { recursive: true, force: true });
   }
 }
 
@@ -37284,7 +38615,7 @@ function registerEdgeCommands(program3) {
 
 // src/schedules-lift-command.ts
 var import_promises8 = require("node:fs/promises");
-var import_node_path39 = require("node:path");
+var import_node_path41 = require("node:path");
 var DEFAULT_WORKFLOWS_DIR = ".github/workflows";
 var SCHEDULE_REPO_RE = /^[A-Za-z0-9_.-]+$/;
 var SchedulesLiftUsageError = class extends Error {
@@ -37311,7 +38642,7 @@ async function readWorkflowFiles(dir) {
   const files = [];
   for (const name of names.sort()) {
     if (!/\.ya?ml$/.test(name)) continue;
-    files.push({ path: `.github/workflows/${name}`, text: await (0, import_promises8.readFile)((0, import_node_path39.join)(dir, name), "utf8") });
+    files.push({ path: `.github/workflows/${name}`, text: await (0, import_promises8.readFile)((0, import_node_path41.join)(dir, name), "utf8") });
   }
   return files;
 }
@@ -37394,8 +38725,8 @@ function registerSchedulesLiftCommand(program3, deps = {}) {
 
 // src/spawn-policy-core.ts
 var import_node_child_process16 = require("node:child_process");
-var import_node_fs43 = require("node:fs");
-var import_node_path40 = require("node:path");
+var import_node_fs45 = require("node:fs");
+var import_node_path42 = require("node:path");
 var SPAWNERS = ["spawn", "spawnSync", "exec", "execSync", "execFile", "execFileSync"];
 var CALL_SOURCE = String.raw`(^|[^.\w$])(${SPAWNERS.join("|")})\s*\(`;
 var SOURCE_EXT = /\.(ts|mts|cts|js|mjs|cjs)$/;
@@ -37481,7 +38812,7 @@ function runSpawnPolicy(root) {
   for (const file of files) {
     let raw;
     try {
-      raw = (0, import_node_fs43.readFileSync)((0, import_node_path40.join)(root, file), "utf8");
+      raw = (0, import_node_fs45.readFileSync)((0, import_node_path42.join)(root, file), "utf8");
     } catch {
       continue;
     }
@@ -37501,19 +38832,19 @@ function runSpawnPolicy(root) {
 function registerDeveloperCommands(program3) {
   const rules = program3.command("rules").description("org-managed .gitignore delivery");
   rules.command("gitignore").option("--write", "upsert the managed block into .gitignore (default: check only, non-zero exit on drift)").option("--json", "machine-readable output").description("verify (or --write) this repo's org-managed .gitignore block matches the SSOT").action((opts) => {
-    const path2 = (0, import_node_path41.join)(process.cwd(), ".gitignore");
-    const current = (0, import_node_fs44.existsSync)(path2) ? (0, import_node_fs44.readFileSync)(path2, "utf8") : null;
+    const path2 = (0, import_node_path43.join)(process.cwd(), ".gitignore");
+    const current = (0, import_node_fs46.existsSync)(path2) ? (0, import_node_fs46.readFileSync)(path2, "utf8") : null;
     const plan = planManagedGitignore(current);
     const drift = [...plan.added.map((l) => `+${l}`), ...plan.removed.map((l) => `-${l}`)].join(", ") || "block normalize";
     if (opts.json) {
-      if (opts.write && plan.changed) (0, import_node_fs44.writeFileSync)(path2, plan.content, "utf8");
+      if (opts.write && plan.changed) (0, import_node_fs46.writeFileSync)(path2, plan.content, "utf8");
       console.log(JSON.stringify(plan, null, 2));
       if (!opts.write && plan.changed) process.exitCode = 1;
       return;
     }
     if (opts.write) {
       if (plan.changed) {
-        (0, import_node_fs44.writeFileSync)(path2, plan.content, "utf8");
+        (0, import_node_fs46.writeFileSync)(path2, plan.content, "utf8");
         console.log(`mmi-cli devops org rules gitignore: updated .gitignore (${drift})`);
       } else {
         console.log("mmi-cli devops org rules gitignore: up to date");
@@ -37771,11 +39102,11 @@ var defaultDeps = {
   // #5813: the caller supplies that command line. `process.argv` is NOT it — the house shim splices
   // the house root out in place, so re-reading it here re-ran the removed flat alias (`release …`
   // instead of `devops release …`) and the converged child refused with exit 2.
-  reexec: (argv) => new Promise((resolve6) => {
+  reexec: (argv) => new Promise((resolve7) => {
     const args = [...argv];
     const child2 = isWin2 ? (0, import_node_child_process17.spawn)("cmd.exe", ["/c", "mmi-cli", ...args], { stdio: "inherit", windowsHide: true }) : (0, import_node_child_process17.spawn)("mmi-cli", args, { stdio: "inherit", windowsHide: true });
-    child2.on("exit", (code) => resolve6(code ?? 1));
-    child2.on("error", () => resolve6(1));
+    child2.on("exit", (code) => resolve7(code ?? 1));
+    child2.on("error", () => resolve7(1));
   }),
   // stderr only — stdout may be carrying --json output.
   warn: (line) => console.error(line)
@@ -37817,7 +39148,7 @@ function clean3(out) {
   return out.trim();
 }
 function sleeper(deps) {
-  return deps.sleep ?? ((ms) => new Promise((resolve6) => setTimeout(resolve6, ms)));
+  return deps.sleep ?? ((ms) => new Promise((resolve7) => setTimeout(resolve7, ms)));
 }
 function normalizeHotfixVersion(input) {
   const m = /^v?(\d+\.\d+\.\d+)$/.exec(input.trim());
@@ -38846,8 +40177,8 @@ async function announceRelease(deps, args) {
 }
 
 // src/train-commands.ts
-var import_node_fs45 = require("node:fs");
-var import_node_path42 = require("node:path");
+var import_node_fs47 = require("node:fs");
+var import_node_path44 = require("node:path");
 var RELEASE_BUMP_INTENTS = ["major", "minor", "patch"];
 function resolveReleaseBumpIntent(raw) {
   const intent = typeof raw === "string" ? raw.trim() : "";
@@ -38858,7 +40189,7 @@ function resolveReleaseBumpIntent(raw) {
 }
 function readRepoVersion() {
   try {
-    return JSON.parse((0, import_node_fs45.readFileSync)((0, import_node_path42.join)(process.cwd(), ".claude-plugin", "plugin.json"), "utf8")).version || void 0;
+    return JSON.parse((0, import_node_fs47.readFileSync)((0, import_node_path44.join)(process.cwd(), ".claude-plugin", "plugin.json"), "utf8")).version || void 0;
   } catch {
     return void 0;
   }
@@ -39041,6 +40372,7 @@ function renderReleaseResume(r) {
   if (r.devRollForward) lines.push(`  development: ${r.devRollForward.note}`);
   if (r.rcAlignment) lines.push(`  rc: ${r.rcAlignment.note}`);
   if (r.checkout) lines.push(`  checkout: ${r.checkout.note}`);
+  if (r.ledger) lines.push(...formatReleaseLedgerReport(r.ledger).map((l, i) => i === 0 ? `  ${l}` : `  ${l}`));
   return lines.join("\n");
 }
 function renderReleaseAbort(r) {
@@ -39120,6 +40452,27 @@ async function runPostReleaseJervDoctor(repo) {
     };
   }
 }
+function buildReleaseVerdict(commandName, result, projectInfoSync) {
+  const alignmentPending = result.devRollForward?.status === "pr-pending" || result.rcAlignment?.status === "pr-pending";
+  const followUpStatus = deriveTrainFollowUpStatus({
+    projectInfo: projectInfoSync && "error" in projectInfoSync ? "failure" : "ok",
+    deploy: deployFollowUpOutcome(result.deployStatus),
+    rcRetirement: result.rcRetirement === "failed" ? result.rcRetirementCategory === "wait-timeout" ? "unresolved" : "failure" : "ok",
+    alignment: alignmentPending ? "unresolved" : "ok",
+    foldPort: "ok"
+  });
+  return {
+    followUpStatus,
+    releaseVerdict: commandName === "release" ? {
+      releaseStatus: "succeeded",
+      followUpStatus,
+      promoted: result.promoted,
+      tag: result.tag,
+      releaseUrl: result.release?.url ?? null,
+      legs: releaseFollowUpLegs(result, projectInfoSync)
+    } : void 0
+  };
+}
 function renderTrainApply(commandName, r) {
   let base = `mmi-cli ${commandName}: promoted ${r.repo} \u2014 ${r.stage} at ${r.tag} [${r.deployModel}]; ${renderDeployLine(r)}`;
   if (r.versionFold) base = `${base}; ${r.versionFold}`;
@@ -39148,9 +40501,14 @@ function renderTrainApply(commandName, r) {
     const failedLegs = v.legs.filter((leg) => leg.status === "failed");
     return [
       `${base}; release verdict: ${verdict}; promoted=${v.promoted}; tag=${v.tag}; release=${v.releaseUrl ?? "unreported"}; follow-up: ${v.followUpStatus.toUpperCase()}`,
-      ...failedLegs.map((leg) => `  - follow-up leg ${leg.leg}: FAILED \u2014 ${leg.error ?? "no diagnostic recorded"}`)
+      ...failedLegs.map((leg) => `  - follow-up leg ${leg.leg}: FAILED \u2014 ${leg.error ?? "no diagnostic recorded"}`),
+      // #5987: the durable ledger's phase legs + derived typed verdict ride the same receipt.
+      ...r.ledger ? formatReleaseLedgerReport(r.ledger).map((line) => `  ${line}`) : []
     ].join("\n");
   }
+  if (r.ledger) {
+    return [base, ...formatReleaseLedgerReport(r.ledger).map((line) => `  ${line}`)].join("\n");
+  }
   return base;
 }
 function applyTrainFollowUpExit(status) {
@@ -39175,7 +40533,7 @@ function registerTrainCommandsAndInventory(program3) {
 }
 function registerTrainOperationsCommands(program3, runProjectInfoSyncCallback) {
   for (const commandName of ["rcand", "release"]) {
-    const trainCmd = program3.command(commandName).description(`plan ${commandName} train operations; mutations require explicit master-admin approval`).option("--json", "machine-readable output").option("--watch", "block on the deploy/publish workflow runs and report their outcomes").option("--apply", "execute the guarded master-only train after explicit approval").option("--resume", commandName === "rcand" ? "finish a candidate whose immutable public rc tag passed policy but origin/rc was not pushed (#3881)" : "finish a partial release or its protected post-release alignment without re-cutting, republishing, or redeploying (#3851/#3885)");
+    const trainCmd = program3.command(commandName).description(`plan ${commandName} train operations; mutations require explicit master-admin approval`).option("--json", "machine-readable output").option("--watch", "block on the deploy/publish workflow runs and report their outcomes").option("--apply", "execute the guarded master-only train after explicit approval").option("--resume", commandName === "rcand" ? "finish a candidate whose immutable public rc tag passed policy but origin/rc was not pushed (#3881)" : "finish a partial release or its protected post-release alignment without re-cutting, republishing, or redeploying (#3851/#3885)").option("--out <path>", "with --apply, write the result to this file as UTF-8 (no BOM) instead of stdout \u2014 the shell-free receipt path (#5983)");
     const RELEASE_ONLY_FLAGS = [
       { flags: "--announce-summary-file <path>", description: "agent-curated 3-6 line Hub Slack summary; required for a new MMI-Hub --apply (#883/#3901)" },
       { flags: "--ack <shas>", description: "comma-separated dev shas a human verified are in the candidate, overriding the hotfix-coverage guard for a conflicted port whose -x trailer was lost (#958)" },
@@ -39211,10 +40569,13 @@ function registerTrainOperationsCommands(program3, runProjectInfoSyncCallback) {
       if (o.retryPublish && commandName !== "release") {
         return fail(`${commandName}: --retry-publish applies only to release. Run: mmi-cli devops release --retry-publish <run-id> --apply --watch`);
       }
+      if (o.out && !o.apply) {
+        return fail(`${commandName}: --out writes the --apply result receipt only \u2014 the dry-run plan and --resume keep their stdout/JSON output. Drop --out${o.resume ? "" : " or rerun with --apply"}`);
+      }
       if (o.retryPublish) {
         if (o.resume || o.abort) return fail("release: --retry-publish cannot be combined with --resume or --abort");
         if (!o.apply) return fail("release: --retry-publish requires --apply after explicit approval; nothing was written");
-        if (o.announceSummaryFile || o.ack || o.dev) return fail("release: --retry-publish accepts only --apply, --watch, --repo and --json");
+        if (o.announceSummaryFile || o.ack || o.dev || o.out) return fail("release: --retry-publish accepts only --apply, --watch, --repo and --json");
         if (o.repo) {
           const guard = planTrainApplyRepoGuard(o.repo, await resolveRepo(), `mmi-cli devops release --retry-publish ${o.retryPublish} --apply${o.watch ? " --watch" : ""}`);
           if (!guard.ok) return fail(`release: ${guard.message}`);
@@ -39238,7 +40599,7 @@ function registerTrainOperationsCommands(program3, runProjectInfoSyncCallback) {
       if (o.abort) {
         if (o.resume) return fail("release: --abort and --resume are mutually exclusive \u2014 abort removes an unpublished tag while resume preserves and promotes it");
         if (!o.apply) return fail("release: --abort requires --apply after explicit approval; nothing was written");
-        if (o.watch || o.announceSummaryFile || o.ack || o.dev) {
+        if (o.watch || o.announceSummaryFile || o.ack || o.dev || o.out) {
           return fail("release: --abort accepts only --apply, --repo and --json; promotion flags cannot be combined with rollback");
         }
         if (o.repo) {
@@ -39313,29 +40674,16 @@ function registerTrainOperationsCommands(program3, runProjectInfoSyncCallback) {
               projectInfoSync = { applied: false, note: `FAILED \u2014 ${error}`, error };
             }
           }
-          const alignmentPending = result.devRollForward?.status === "pr-pending" || result.rcAlignment?.status === "pr-pending";
-          const followUpStatus = deriveTrainFollowUpStatus({
-            projectInfo: projectInfoSync && "error" in projectInfoSync ? "failure" : "ok",
-            deploy: deployFollowUpOutcome(result.deployStatus),
-            rcRetirement: result.rcRetirement === "failed" ? result.rcRetirementCategory === "wait-timeout" ? "unresolved" : "failure" : "ok",
-            alignment: alignmentPending ? "unresolved" : "ok",
-            foldPort: "ok"
-          });
-          const releaseVerdict = commandName === "release" ? {
-            releaseStatus: "succeeded",
-            followUpStatus,
-            promoted: result.promoted,
-            tag: result.tag,
-            releaseUrl: result.release?.url ?? null,
-            legs: releaseFollowUpLegs(result, projectInfoSync)
-          } : void 0;
+          const { followUpStatus, releaseVerdict } = buildReleaseVerdict(commandName, result, projectInfoSync);
           const reported = {
             ...result,
             ...projectInfoSync ? { projectInfoSync } : {},
             ...postReleaseJervDoctor ? { postReleaseJervDoctor } : {},
             ...releaseVerdict ? { releaseVerdict } : {}
           };
-          printLine(o.json ? JSON.stringify(reported, null, 2) : renderTrainApply(commandName, reported));
+          const output = o.json ? JSON.stringify(reported, null, 2) : renderTrainApply(commandName, reported);
+          if (!o.out) printLine(output);
+          else printLine(`Wrote ${commandName} apply result to ${o.out} (UTF-8, ${writeUtf8Receipt(o.out, output)} bytes)`);
           applyTrainFollowUpExit(followUpStatus);
           return;
         } catch (e) {
@@ -39477,12 +40825,12 @@ ${r.stderr ?? ""}`).catch(() => "");
 var ENV_HEAL_LOCK_STALE_MS = 10 * 6e4;
 var ENV_HEAL_LOCK_MAX_WAIT_MS = 2 * 6e4;
 function envHealLockPath(home) {
-  return (0, import_node_path43.join)(home, ".claude", "plugins", ".mmi-env-heal.lock");
+  return (0, import_node_path45.join)(home, ".claude", "plugins", ".mmi-env-heal.lock");
 }
 async function withEnvHealLock(what, run) {
   try {
     return await withFileLock(
-      envHealLockPath((0, import_node_os19.homedir)()),
+      envHealLockPath((0, import_node_os20.homedir)()),
       { staleMs: ENV_HEAL_LOCK_STALE_MS, maxWaitMs: ENV_HEAL_LOCK_MAX_WAIT_MS, label: "mmi env-heal lock" },
       run
     );
@@ -39578,7 +40926,7 @@ function mmiDoctorDeps(opts = {}) {
       const configRoot = surfaceConfigRoot(surface);
       const running = surface === "codex" ? installedActivePluginVersion(surface) : runningPluginVersion(process.env, resolveClientVersion());
       const plan = buildPluginCachePlan(
-        (0, import_node_os19.homedir)(),
+        (0, import_node_os20.homedir)(),
         running,
         pluginCacheFsDeps(configRoot, () => 0),
         { configRoot, includeStaging: surface !== "codex" }
@@ -39606,14 +40954,14 @@ function mmiDoctorDeps(opts = {}) {
       const running = surface === "codex" ? installedActivePluginVersion(surface) : runningPluginVersion(process.env, resolveClientVersion());
       const installed = installedActivePluginVersion(surface);
       const plan = buildPluginCachePlan(
-        (0, import_node_os19.homedir)(),
+        (0, import_node_os20.homedir)(),
         running,
         pluginCacheFsDeps(configRoot, () => 0),
         { configRoot, includeStaging: surface !== "codex", installedVersion: installed }
       );
       const result = applyPluginCachePlan(
         plan,
-        (p) => (0, import_node_fs46.rmSync)(p, { recursive: true }),
+        (p) => (0, import_node_fs48.rmSync)(p, { recursive: true }),
         stagingApplyFsGuard(configRoot)
       );
       return {
@@ -39648,7 +40996,7 @@ function mmiDoctorDeps(opts = {}) {
     // has no generated routing index would
     // get a permanent — demanding an artifact it never asked for.
     docsIndexState: (root) => {
-      if (!(0, import_node_fs46.existsSync)((0, import_node_path43.join)(root, DOCS_INDEX_PATH))) return void 0;
+      if (!(0, import_node_fs48.existsSync)((0, import_node_path45.join)(root, DOCS_INDEX_PATH))) return void 0;
       const real = createDocsIndexDeps(root);
       let docs;
       const listDocs = () => docs ??= real.listDocs();
@@ -39657,7 +41005,7 @@ function mmiDoctorDeps(opts = {}) {
     },
     // #4168: working-tree heal — write if drifted, then re-check. Commit remains the operator's step.
     healDocsIndex: (root) => {
-      if (!(0, import_node_fs46.existsSync)((0, import_node_path43.join)(root, DOCS_INDEX_PATH))) return { drift: false, docCount: 0 };
+      if (!(0, import_node_fs48.existsSync)((0, import_node_path45.join)(root, DOCS_INDEX_PATH))) return { drift: false, docCount: 0 };
       const real = createDocsIndexDeps(root);
       let docs;
       const listDocs = () => docs ??= real.listDocs();
@@ -39678,8 +41026,8 @@ function mmiDoctorDeps(opts = {}) {
         });
         const raced = await Promise.race([
           work.then((r) => ({ ...r, timedOut: false })),
-          new Promise((resolve6) => {
-            ceiling = setTimeout(() => resolve6({ timedOut: true, scanned: 0, findings: 0, fixed: 0, failed: 0 }), BOARD_DOCTOR_TIMEOUT_MS);
+          new Promise((resolve7) => {
+            ceiling = setTimeout(() => resolve7({ timedOut: true, scanned: 0, findings: 0, fixed: 0, failed: 0 }), BOARD_DOCTOR_TIMEOUT_MS);
           })
         ]);
         if (raced.timedOut) return { scanned: 0, findings: 0, fixed: 0, failed: 0, timedOut: true };
@@ -39712,8 +41060,8 @@ function mmiDoctorDeps(opts = {}) {
             incomplete: nb.incomplete,
             timedOut: false
           })),
-          new Promise((resolve6) => {
-            ceiling = setTimeout(() => resolve6({ driftLines: [], incomplete: [], timedOut: true }), SCHEDULES_DRIFT_TIMEOUT_MS);
+          new Promise((resolve7) => {
+            ceiling = setTimeout(() => resolve7({ driftLines: [], incomplete: [], timedOut: true }), SCHEDULES_DRIFT_TIMEOUT_MS);
           })
         ]);
         if (!raced.timedOut && raced.incomplete.length === 0) writeSchedulesDriftCache(cachePath, raced.driftLines);
@@ -40228,7 +41576,7 @@ project.command("set [owner/repo]").description("upsert project META (idempotent
   if (dupe) return fail(`org project set: KEY "${dupe}" was passed to both --var and --set; --set is an alias of --var, so pass each KEY once`);
   if (o.secretsFile) {
     try {
-      vars.push(`secrets=${(0, import_node_fs46.readFileSync)(o.secretsFile, "utf8")}`);
+      vars.push(`secrets=${(0, import_node_fs48.readFileSync)(o.secretsFile, "utf8")}`);
     } catch (e) {
       return fail(`org project set: cannot read --secrets-file ${o.secretsFile}: ${e.message}`);
     }
@@ -40541,16 +41889,16 @@ function ciAuditDeps2() {
     // gate re-seed step is skipped gracefully rather than failing mid-run.
     readSeedFile: (path2) => {
       if (!root) return null;
-      const fullPath = (0, import_node_path43.join)(root, path2);
-      return (0, import_node_fs46.existsSync)(fullPath) ? (0, import_node_fs46.readFileSync)(fullPath, "utf8") : null;
+      const fullPath = (0, import_node_path45.join)(root, path2);
+      return (0, import_node_fs48.existsSync)(fullPath) ? (0, import_node_fs48.readFileSync)(fullPath, "utf8") : null;
     }
   };
 }
 function hubRoot2() {
-  const fromPkg = (0, import_node_path43.join)(__dirname, "..", "..");
+  const fromPkg = (0, import_node_path45.join)(__dirname, "..", "..");
   const marker = "skills/bootstrap/seeds/manifest.json";
-  if ((0, import_node_fs46.existsSync)((0, import_node_path43.join)(fromPkg, marker))) return fromPkg;
-  if ((0, import_node_fs46.existsSync)((0, import_node_path43.join)(process.cwd(), marker))) return process.cwd();
+  if ((0, import_node_fs48.existsSync)((0, import_node_path45.join)(fromPkg, marker))) return fromPkg;
+  if ((0, import_node_fs48.existsSync)((0, import_node_path45.join)(process.cwd(), marker))) return process.cwd();
   return null;
 }
 registerQueryCommands(program2);
@@ -40650,10 +41998,10 @@ access.command("audit").description("audit collaborator roles + train-branch pus
     targets = resolution.targets;
   }
   const derivedMatrix = registryProjects ? accessMatrixFromProjects(registryProjects) : {};
-  const fileMatrix = (0, import_node_fs46.existsSync)("access-matrix.json") ? loadAccessMatrix((0, import_node_fs46.readFileSync)("access-matrix.json", "utf8")) : {};
+  const fileMatrix = (0, import_node_fs48.existsSync)("access-matrix.json") ? loadAccessMatrix((0, import_node_fs48.readFileSync)("access-matrix.json", "utf8")) : {};
   const matrix = mergeAccessMatrix(fileMatrix, derivedMatrix);
   const dataAccess = registryProjects ? dataAccessContractsFromProjects(registryProjects) : { consumers: {} };
-  const sanctioned = (0, import_node_fs46.existsSync)("access-matrix.json") ? loadSanctionedAdmins((0, import_node_fs46.readFileSync)("access-matrix.json", "utf8")) : {};
+  const sanctioned = (0, import_node_fs48.existsSync)("access-matrix.json") ? loadSanctionedAdmins((0, import_node_fs48.readFileSync)("access-matrix.json", "utf8")) : {};
   const report = await auditOrgAccess(targets, deps, matrix, dataAccess, sanctioned);
   console.log(o.json ? JSON.stringify(report, null, 2) : renderAccessReport(report));
   if (!report.ok) process.exitCode = 1;
@@ -40684,16 +42032,16 @@ function directoryBytes(path2) {
   let total = 0;
   let entries;
   try {
-    entries = (0, import_node_fs46.readdirSync)(path2, { withFileTypes: true });
+    entries = (0, import_node_fs48.readdirSync)(path2, { withFileTypes: true });
   } catch {
     return 0;
   }
   for (const entry of entries) {
-    const child2 = (0, import_node_path43.join)(path2, entry.name);
+    const child2 = (0, import_node_path45.join)(path2, entry.name);
     if (entry.isDirectory()) total += directoryBytes(child2);
     else {
       try {
-        total += (0, import_node_fs46.statSync)(child2).size;
+        total += (0, import_node_fs48.statSync)(child2).size;
       } catch {
       }
     }
@@ -40701,25 +42049,25 @@ function directoryBytes(path2) {
   return total;
 }
 function listDirEntries(dir) {
-  return (0, import_node_fs46.readdirSync)(dir, { withFileTypes: true }).map((d) => ({ name: d.name, isDirectory: d.isDirectory() }));
+  return (0, import_node_fs48.readdirSync)(dir, { withFileTypes: true }).map((d) => ({ name: d.name, isDirectory: d.isDirectory() }));
 }
 function readInstalledPluginRefs(configRoot) {
   const p = installedPluginsPathForConfig(configRoot);
-  if (!(0, import_node_fs46.existsSync)(p)) return [];
+  if (!(0, import_node_fs48.existsSync)(p)) return [];
   try {
-    return installedPluginPaths((0, import_node_fs46.readFileSync)(p, "utf8"));
+    return installedPluginPaths((0, import_node_fs48.readFileSync)(p, "utf8"));
   } catch {
     return null;
   }
 }
 function pluginCacheFsDeps(configRoot, dirBytes) {
   return {
-    exists: (p) => (0, import_node_fs46.existsSync)(p),
-    listVersionDirs: (root) => (0, import_node_fs46.readdirSync)(root, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name),
+    exists: (p) => (0, import_node_fs48.existsSync)(p),
+    listVersionDirs: (root) => (0, import_node_fs48.readdirSync)(root, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name),
     dirBytes,
-    listStagingDirs: (root) => (0, import_node_fs46.readdirSync)(root, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => {
+    listStagingDirs: (root) => (0, import_node_fs48.readdirSync)(root, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => {
       try {
-        return { name: d.name, mtimeMs: newestMtimeMs((0, import_node_path43.join)(root, d.name), listDirEntries, (p) => (0, import_node_fs46.statSync)(p).mtimeMs) };
+        return { name: d.name, mtimeMs: newestMtimeMs((0, import_node_path45.join)(root, d.name), listDirEntries, (p) => (0, import_node_fs48.statSync)(p).mtimeMs) };
       } catch {
         return { name: d.name, mtimeMs: Date.now() };
       }
@@ -40733,10 +42081,10 @@ function stagingApplyFsGuard(configRoot) {
   return {
     referencedPaths: () => readInstalledPluginRefs(configRoot),
     mtimeMs: (name) => {
-      const p = (0, import_node_path43.join)(stagingRoot, name);
-      if (!(0, import_node_fs46.existsSync)(p)) return null;
+      const p = (0, import_node_path45.join)(stagingRoot, name);
+      if (!(0, import_node_fs48.existsSync)(p)) return null;
       try {
-        return newestMtimeMs(p, listDirEntries, (q) => (0, import_node_fs46.statSync)(q).mtimeMs);
+        return newestMtimeMs(p, listDirEntries, (q) => (0, import_node_fs48.statSync)(q).mtimeMs);
       } catch {
         return null;
       }
@@ -40756,13 +42104,13 @@ program2.command("plugin-prune").description(`prune stale cached MMI plugin vers
     return;
   }
   const plan = buildPluginCachePlan(
-    (0, import_node_os19.homedir)(),
+    (0, import_node_os20.homedir)(),
     running,
     pluginCacheFsDeps(configRoot, directoryBytes),
     { withBytes: true, configRoot, includeStaging: surface !== "codex" }
   );
   const anythingToDelete = plan.prune.length > 0 || plan.staging.length > 0;
-  const result = o.apply && anythingToDelete ? applyPluginCachePlan(plan, (p) => (0, import_node_fs46.rmSync)(p, { recursive: true, force: true }), stagingApplyFsGuard(configRoot)) : void 0;
+  const result = o.apply && anythingToDelete ? applyPluginCachePlan(plan, (p) => (0, import_node_fs48.rmSync)(p, { recursive: true, force: true }), stagingApplyFsGuard(configRoot)) : void 0;
   const warnings = plan.prune.length > 0 ? [CONCURRENT_SESSION_WARNING] : [];
   if (o.json) console.log(JSON.stringify({ ...plan, warnings, applied: result ?? null }));
   else console.log(renderPluginCachePlan(plan, result));