@mutmutco/cli 4.3.15 → 4.3.17

package/dist/main.cjs

@@ -3416,7 +3416,7 @@ function useColor() {
 var program = new Command();
 
 // src/command-composition.ts
-var import_node_fs49 = require("node:fs");
+var import_node_fs50 = require("node:fs");
 
 // src/clean-exit.ts
 var UNDICI_GLOBAL_DISPATCHER_SYMBOL = Object.getOwnPropertySymbols(globalThis).find(
@@ -5226,8 +5226,8 @@ function unknownCommandDomainGuide(parentPath, token) {
 }
 
 // src/command-composition.ts
-var import_node_os21 = require("node:os");
-var import_node_path46 = require("node:path");
+var import_node_os22 = require("node:os");
+var import_node_path47 = require("node:path");
 
 // src/board-read.ts
 var import_node_fs13 = require("node:fs");
@@ -12917,6 +12917,18 @@ function rulesetRequiredContexts(ruleset) {
   }
   return contexts;
 }
+function rulesetStrictPolicy(ruleset) {
+  const rules = (ruleset.rules ?? []).filter((rule) => rule.type === "required_status_checks");
+  return rules.length > 0 && rules.every((rule) => rule.parameters?.strict_required_status_checks_policy === true);
+}
+function patchRulesetStrictPolicy(body) {
+  const rules = (body.rules ?? []).map((rule) => {
+    const r = rule;
+    if (r.type !== "required_status_checks") return rule;
+    return { ...r, parameters: { ...r.parameters, strict_required_status_checks_policy: true } };
+  });
+  return { ...body, rules };
+}
 function rulesetBranchIncludes(ruleset) {
   const raw = ruleset.conditions?.ref_name?.include;
   return Array.isArray(raw) ? [...new Set(raw.filter((ref) => typeof ref === "string" && ref.length > 0))].sort((a, b) => a.localeCompare(b)) : [];
@@ -12936,7 +12948,8 @@ function patchRulesetRequiredContexts(body, contexts) {
       ...r,
       parameters: {
         ...r.parameters,
-        strict_required_status_checks_policy: r.parameters?.strict_required_status_checks_policy ?? false,
+        strict_required_status_checks_policy: true,
+        // #6263: org policy — see patchRulesetStrictPolicy
         required_status_checks: sorted.map((context) => ({ context }))
       }
     };
@@ -13023,6 +13036,7 @@ async function gateIsProvenGreen(repo, client, baseBranch, gateFiles = DEFAULT_G
 }
 async function activateProductRuleset(repo, rulesetBody, client, enforcement = "active") {
   const want = new Set(rulesetRequiredContexts({ rules: rulesetBody.rules }));
+  const wantStrict = rulesetStrictPolicy({ rules: rulesetBody.rules });
   const wantBranches = rulesetBranchIncludes(rulesetBody);
   const list = await client.rest("GET", `repos/${repo}/rulesets`, { timeoutMs: 2e4 });
   const existing = findProductRuleset(list ?? []);
@@ -13034,8 +13048,9 @@ async function activateProductRuleset(repo, rulesetBody, client, enforcement = "
     const have = new Set(rulesetRequiredContexts(detail));
     const haveBranches = rulesetBranchIncludes(detail);
     const branchesMatch = haveBranches.length === wantBranches.length && wantBranches.every((ref, index) => ref === haveBranches[index]);
-    if (detail.enforcement === effective && branchesMatch && have.size === want.size && [...want].every((c) => have.has(c))) {
-      return { action: "skipped", enforcement: effective, detail: `${effective} ruleset already matches required contexts and branches${kept}` };
+    const strictMatch = rulesetStrictPolicy(detail) === wantStrict;
+    if (detail.enforcement === effective && branchesMatch && strictMatch && have.size === want.size && [...want].every((c) => have.has(c))) {
+      return { action: "skipped", enforcement: effective, detail: `${effective} ruleset already matches required contexts, branches and up-to-date policy${kept}` };
     }
     await client.rest("PUT", `repos/${repo}/rulesets/${existing.id}`, { body: { ...rulesetBody, enforcement: effective }, timeoutMs: 2e4 });
     return { action: "updated", enforcement: effective, detail: `ruleset ${existing.id}${kept}` };
@@ -13706,7 +13721,7 @@ function createDocsIndexDeps(repoRoot2) {
 }
 
 // src/gate-budget.ts
-var BLESSED_RUN_WITH_BUDGET_SHA = "ea2cf8710949dec53566c29836e29cd7515a4e23";
+var BLESSED_RUN_WITH_BUDGET_SHA = "5ce541add569e54e7ca96de67a768577d3d604e4";
 var BLESSED_RUNNER_GATE_SHA = "a6ee756d94fd95884451381e94408f0348eb11db";
 var REMOTE_USE = /^mutmutco\/MMI-Hub\/\.github\/actions\/run-with-budget@(\S+)$/;
 var LOCAL_USE = "./.github/actions/run-with-budget";
@@ -14044,6 +14059,8 @@ function gateSeedVars(cls, releaseTrack, runtime = "node", requiredCheckBranches
   const runtimeVars = {
     GATE_RUNTIME: runtime,
     GATE_CMD: rt.cmd,
+    // #6254: affected-only PR command; empty means "same as GATE_CMD" (withDerivedRepoVars fills it).
+    GATE_AFFECTED_CMD: "",
     GATE_INSTALL_CMD: rt.install,
     GATE_WORKDIR: ".",
     GATE_CACHE_DEP_PATH: "package-lock.json",
@@ -14091,6 +14108,7 @@ function withDerivedRepoVars(vars, parsed, cls, releaseTrack, requiredCheckBranc
   for (const [key, value] of Object.entries(gateSeedVars(cls, track, runtime, requiredCheckBranches))) {
     out[key] ??= value;
   }
+  if (!out.GATE_AFFECTED_CMD.trim()) out.GATE_AFFECTED_CMD = out.GATE_CMD;
   return out;
 }
 function gateConfigToVars(gate) {
@@ -14098,6 +14116,7 @@ function gateConfigToVars(gate) {
   if (!gate || typeof gate !== "object") return out;
   if (gate.runtime === "node" || gate.runtime === "python") out.GATE_RUNTIME = gate.runtime;
   if (typeof gate.cmd === "string" && gate.cmd.trim()) out.GATE_CMD = gate.cmd;
+  if (typeof gate.affectedCmd === "string" && gate.affectedCmd.trim()) out.GATE_AFFECTED_CMD = gate.affectedCmd;
   if (typeof gate.workdir === "string" && gate.workdir.trim()) out.GATE_WORKDIR = gate.workdir;
   if (typeof gate.cacheDepPath === "string" && gate.cacheDepPath.trim()) out.GATE_CACHE_DEP_PATH = gate.cacheDepPath;
   if (typeof gate.pyVersion === "string" && gate.pyVersion.trim()) out.GATE_PY_VERSION = gate.pyVersion;
@@ -15483,10 +15502,10 @@ var rollout_plan_default = {
     note: "The v4.0.0 stamp happens at cut time (D6e #4463); until then the candidate is the origin/development head artifacts (built cli/dist + npm pack), identity proven by dist content hash (D6a)."
   },
   baseline: {
-    version: "4.3.15",
-    tag: "v4.3.15",
-    commit: "006f11ed8921",
-    npm: "@mutmutco/cli@4.3.15"
+    version: "4.3.17",
+    tag: "v4.3.17",
+    commit: "3b07c941910b",
+    npm: "@mutmutco/cli@4.3.17"
   },
   exitCriterion: "fleet-n-of-n",
   hubOnlyShortcut: "forbidden",
@@ -15503,14 +15522,14 @@ var rollout_plan_default = {
           repo: "mutmutco/mmi-hub",
           role: "canary",
           schedule: "train",
-          v3Target: "v4.3.15"
+          v3Target: "v4.3.17"
         }
       ],
       rollbackTrigger: "Any red inside the post-contract soak window: `devops train gate` FAIL attributable to the v4 doors, Hub endpoint health probe failure, a pre-v4 client admitted instead of receiving actionable HTTP 426, or npm consumer install/doctor failure on the v4-only dist.",
       rollback: {
         independent: true,
-        mechanism: "npm dist-tag latest -> 4.3.15 and redeploy the Hub Lambda from tag v4.3.15 (006f11ed8921); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
-        v3Target: "v4.3.15 (@mutmutco/cli@4.3.15, tag commit 006f11ed8921 \u2014 last known-good release carrying the repo-index v4-only contract)"
+        mechanism: "npm dist-tag latest -> 4.3.17 and redeploy the Hub Lambda from tag v4.3.17 (3b07c941910b); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
+        v3Target: "v4.3.17 (@mutmutco/cli@4.3.17, tag commit 3b07c941910b \u2014 last known-good release carrying the repo-index v4-only contract)"
       }
     },
     {
@@ -23507,12 +23526,13 @@ function parseAuthoritativeRuleset(raw, meta, repo) {
   const registryContexts = registryRequiredContexts(meta);
   const contexts = sortedUnique(registryContexts ?? committedContexts);
   const explicitBranches = Array.isArray(meta?.requiredCheckBranches) && meta.requiredCheckBranches.length > 0 ? resolveRequiredCheckBranches(meta, repo) : null;
-  let apiPayload = registryContexts == null ? committedPayload : patchRulesetRequiredContexts(committedPayload, contexts);
+  const committedStrict = rulesetStrictPolicy(committedPayload);
+  let apiPayload = patchRulesetStrictPolicy(registryContexts == null ? committedPayload : patchRulesetRequiredContexts(committedPayload, contexts));
   if (explicitBranches) apiPayload = patchRulesetBranchIncludes(apiPayload, explicitBranches);
   const branchIncludes = rulesetBranchIncludes(apiPayload);
   const authoritativeFilePayload = {
     ...filePayload,
-    ...registryContexts == null ? {} : { rules: apiPayload.rules },
+    ...registryContexts == null && committedStrict ? {} : { rules: apiPayload.rules },
     ...explicitBranches == null ? {} : { conditions: apiPayload.conditions }
   };
   return {
@@ -23522,6 +23542,7 @@ function parseAuthoritativeRuleset(raw, meta, repo) {
     contexts,
     branchIncludes,
     committedBranchIncludes,
+    committedStrict,
     branchSource: explicitBranches ? "registry META requiredCheckBranches" : "committed ruleset reference",
     source: registryContexts == null ? "committed ruleset reference" : "registry META requiredChecks",
     coversReleaseBranches: rulesetCoversReleaseBranches(apiPayload, resolveReleaseTrack(meta, void 0, repo))
@@ -23533,8 +23554,9 @@ function sameContexts(left, right) {
 function resolveProductRulesetReconcilePlan(input) {
   const liveNeedsContextConvergence = !sameContexts(input.liveContexts, input.authorityContexts);
   const liveNeedsBranchConvergence = input.liveBranchIncludes !== void 0 && input.authorityBranchIncludes !== void 0 && !sameContexts(input.liveBranchIncludes, input.authorityBranchIncludes);
+  const liveNeedsStrictConvergence = input.liveStrict === false;
   const liveIsActive = input.liveEnforcement === "active";
-  if (liveIsActive && !liveNeedsContextConvergence && !liveNeedsBranchConvergence) {
+  if (liveIsActive && !liveNeedsContextConvergence && !liveNeedsBranchConvergence && !liveNeedsStrictConvergence) {
     return { shouldActivate: false, targetEnforcement: "active" };
   }
   if (input.unsafeContexts.length > 0) {
@@ -23722,6 +23744,7 @@ async function auditRepoCi(repo, deps) {
     const productRuleset = rulesets.find((r) => r.name === PRODUCT_RULESET_NAME);
     const liveContexts = productRuleset == null ? [] : sortedUnique(rulesetRequiredContexts(productRuleset));
     const liveBranchIncludes = productRuleset == null ? [] : rulesetBranchIncludes(productRuleset);
+    const liveStrict = productRuleset != null && rulesetStrictPolicy(productRuleset);
     const hasRequiredChecks = productRuleset?.enforcement === "active" && liveContexts.length > 0;
     checks.push({
       ok: hasRequiredChecks,
@@ -23742,11 +23765,12 @@ async function auditRepoCi(repo, deps) {
         const liveContextsAligned = sameContexts(liveContexts, authoritativeRuleset.contexts);
         const fileBranchesAligned = sameContexts(authoritativeRuleset.committedBranchIncludes, authoritativeRuleset.branchIncludes);
         const liveBranchesAligned = sameContexts(liveBranchIncludes, authoritativeRuleset.branchIncludes);
-        const aligned = fileContextsAligned && liveContextsAligned && fileBranchesAligned && liveBranchesAligned;
+        const strictAligned = authoritativeRuleset.committedStrict && liveStrict;
+        const aligned = fileContextsAligned && liveContextsAligned && fileBranchesAligned && liveBranchesAligned && strictAligned;
         checks.push({
           ok: aligned,
           label: RULESET_REFERENCE_MATCH_LABEL,
-          detail: aligned ? `contexts [${authoritativeRuleset.contexts.join(", ")}] and branches [${authoritativeRuleset.branchIncludes.join(", ")}] match declared authority` : `${authoritativeRuleset.source} requires contexts [${authoritativeRuleset.contexts.join(", ")}]; ${authoritativeRuleset.branchSource} requires branches [${authoritativeRuleset.branchIncludes.join(", ")}]; ${PRODUCT_RULESET_REF} declares contexts [${authoritativeRuleset.committedContexts.join(", ")}] / branches [${authoritativeRuleset.committedBranchIncludes.join(", ")}] and live ${PRODUCT_RULESET_NAME} has contexts [${liveContexts.join(", ")}] / branches [${liveBranchIncludes.join(", ")}]`,
+          detail: aligned ? `contexts [${authoritativeRuleset.contexts.join(", ")}], branches [${authoritativeRuleset.branchIncludes.join(", ")}] and the up-to-date policy match declared authority` : `${authoritativeRuleset.source} requires contexts [${authoritativeRuleset.contexts.join(", ")}]; ${authoritativeRuleset.branchSource} requires branches [${authoritativeRuleset.branchIncludes.join(", ")}]; ${PRODUCT_RULESET_REF} declares contexts [${authoritativeRuleset.committedContexts.join(", ")}] / branches [${authoritativeRuleset.committedBranchIncludes.join(", ")}] and live ${PRODUCT_RULESET_NAME} has contexts [${liveContexts.join(", ")}] / branches [${liveBranchIncludes.join(", ")}]` + (strictAligned ? "" : `; strict_required_status_checks_policy must be true (require branches to be up to date before merging, #6263) \u2014 ${PRODUCT_RULESET_REF} declares ${authoritativeRuleset.committedStrict}, live ${PRODUCT_RULESET_NAME} has ${liveStrict}`),
           remediation: aligned ? void 0 : `mmi-cli devops ci reconcile --repo ${repo} --apply`
         });
       }
@@ -24280,7 +24304,7 @@ async function applyCiReconcileRepo(repo, deps) {
     result.errors.push(`${authority.source} declares no required contexts`);
     return finalizeCiReconcile(repo, deps, result, report);
   }
-  const sourceNeedsConvergence = !sameContexts(authority.committedContexts, authority.contexts) || !sameContexts(authority.committedBranchIncludes, authority.branchIncludes);
+  const sourceNeedsConvergence = !sameContexts(authority.committedContexts, authority.contexts) || !sameContexts(authority.committedBranchIncludes, authority.branchIncludes) || !authority.committedStrict;
   if (sourceNeedsConvergence) {
     try {
       const delivery = await deliverSeedFile(
@@ -24335,6 +24359,7 @@ async function applyCiReconcileRepo(repo, deps) {
     authorityContexts: authority.contexts,
     liveBranchIncludes,
     authorityBranchIncludes: authority.branchIncludes,
+    liveStrict: live == null ? void 0 : rulesetStrictPolicy(live),
     gateProvenGreen: await gateIsProvenGreen(repo, deps.client, baseBranch, gateFiles),
     unsafeContexts: unsafe
   });
@@ -24343,7 +24368,7 @@ async function applyCiReconcileRepo(repo, deps) {
       result.skipped.push(plan.holdReason);
       return finalizeCiReconcile(repo, deps, result, report, plan.holdReason);
     }
-    result.skipped.push(`live ${PRODUCT_RULESET_NAME} contexts and branches already match declared authority`);
+    result.skipped.push(`live ${PRODUCT_RULESET_NAME} contexts, branches and up-to-date policy already match declared authority`);
     return finalizeCiReconcile(repo, deps, result, report);
   }
   try {
@@ -27142,6 +27167,11 @@ async function verifyBootstrap(repo, repoClass, deps, releaseTrack) {
       label: "product required-check ruleset enforcement active",
       detail: productRuleset?.enforcement !== "active" ? `${PRODUCT_RULESET_NAME} is ${productRuleset?.enforcement ?? "missing"} \u2014 run mmi-cli devops ci reconcile --apply --repo ${repo} once the gate is green` : void 0
     });
+    checks.push({
+      ok: productRuleset != null && rulesetStrictPolicy(productRuleset),
+      label: "product required-check ruleset requires an up-to-date branch",
+      detail: productRuleset != null && rulesetStrictPolicy(productRuleset) ? void 0 : `${PRODUCT_RULESET_NAME} ${productRuleset == null ? "is missing" : "has strict_required_status_checks_policy=false"} \u2014 run mmi-cli devops ci reconcile --apply --repo ${repo} (#6263)`
+    });
     const statusChecks = rulesetStatusChecks2(rulesets.filter((r) => r.target === "branch" && r.enforcement === "active"));
     const missing = requiredProductStatusChecks.filter((check) => !statusChecks.has(check));
     checks.push({
@@ -28778,7 +28808,7 @@ function parseGateVar(raw) {
     throw new Error('org project set: gate must be JSON, e.g. {"runtime":"python","cmd":"pytest","workdir":"app"}');
   }
   if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
-    throw new Error("org project set: gate must be a {runtime,cmd,workdir,cacheDepPath,pyVersion} object");
+    throw new Error("org project set: gate must be a {runtime,cmd,affectedCmd,workdir,cacheDepPath,pyVersion} object");
   }
   const map = parsed;
   const out = {};
@@ -28786,11 +28816,11 @@ function parseGateVar(raw) {
     if (key === "runtime") {
       if (value !== "node" && value !== "python") throw new Error('org project set: gate.runtime must be "node" or "python"');
       out.runtime = value;
-    } else if (key === "cmd" || key === "workdir" || key === "cacheDepPath" || key === "pyVersion") {
+    } else if (key === "cmd" || key === "affectedCmd" || key === "workdir" || key === "cacheDepPath" || key === "pyVersion") {
       if (typeof value !== "string" || !value.trim()) throw new Error(`org project set: gate.${key} must be a non-empty string`);
       out[key] = value.trim();
     } else {
-      throw new Error(`org project set: gate key "${key}" \u2014 expected only runtime/cmd/workdir/cacheDepPath/pyVersion`);
+      throw new Error(`org project set: gate key "${key}" \u2014 expected only runtime/cmd/affectedCmd/workdir/cacheDepPath/pyVersion`);
     }
   }
   return out;
@@ -28891,7 +28921,7 @@ var SETTABLE_VAR_HINTS = {
   requiredChecks: 'JSON array, e.g. ["gate"] or [] for no-ci',
   requiredCheckBranches: "non-empty JSON branch-name array; exact product-ruleset scope (#5210)",
   ciExemptReason: "non-empty string \u2014 declares this deployable repo has no CI surface (#4265)",
-  gate: "JSON {runtime,cmd,workdir,cacheDepPath,pyVersion}"
+  gate: "JSON {runtime,cmd,affectedCmd,workdir,cacheDepPath,pyVersion}"
 };
 function settableVarHelp() {
   const keys = SETTABLE_VAR_KEYS.map((k) => {
@@ -35908,8 +35938,8 @@ function renderVerifySecrets(body) {
 }
 
 // src/command-register-collaboration.ts
-var import_node_child_process15 = require("node:child_process");
-var import_node_fs42 = require("node:fs");
+var import_node_child_process16 = require("node:child_process");
+var import_node_fs43 = require("node:fs");
 var import_promises7 = require("node:fs/promises");
 
 // src/session-runtime.ts
@@ -35929,7 +35959,7 @@ function spawnDetachedSelf(args, deps, opts = {}) {
 }
 
 // src/command-register-collaboration.ts
-var import_node_path39 = require("node:path");
+var import_node_path40 = require("node:path");
 
 // src/attach-to-project.ts
 function boardAttachRateLimitedReceipt(resetEpochSeconds) {
@@ -36006,6 +36036,47 @@ function applyChecklistCheck(body, query, checked) {
 }
 
 // src/pr-land.ts
+function prHeadBehindBase(input) {
+  if ((input.mergeStateStatus ?? "").toUpperCase() === "BEHIND") return true;
+  return /out[- ]of[- ]date|not up to date|up to date with the base|update (?:the|your) branch/i.test(input.message ?? "");
+}
+function prHeadUpdateRemedy(head, base) {
+  return `git fetch origin ${base} && git merge origin/${base} (on ${head}), resolve the conflicts, push, then rerun \u2014 docs/Guides/train-troubleshooting.md#head-behind-base`;
+}
+var PR_HEAD_UPDATE_API_READ_RETRIES = 5;
+var PR_HEAD_UPDATE_API_READ_DELAY_MS = 2e3;
+async function updatePrHeadFromBase(input) {
+  const remedy = prHeadUpdateRemedy(input.head, input.base);
+  if (input.localCheckedOut) {
+    const from2 = (await input.git(["rev-parse", "HEAD"])).trim();
+    await input.git(["fetch", "origin", input.base]);
+    try {
+      await input.git(["merge", "--no-ff", "--no-edit", `origin/${input.base}`]);
+    } catch (e) {
+      await input.git(["merge", "--abort"]).catch(() => {
+      });
+      throw new Error(`updating ${input.head} from ${input.base} conflicted (${e.message.trim()}) \u2014 ${remedy}`);
+    }
+    await input.git(["push", "origin", input.head]);
+    const to = (await input.git(["rev-parse", "HEAD"])).trim();
+    return { from: from2, to, base: input.base, via: "local-merge" };
+  }
+  const pullPath = `repos/${input.repo}/pulls/${input.prNumber}`;
+  const readHead2 = async () => (await input.rest("GET", pullPath)).head?.sha ?? "";
+  const from = await readHead2();
+  try {
+    await input.rest("PUT", `${pullPath}/update-branch`, from ? { expected_head_sha: from } : void 0);
+  } catch (e) {
+    throw new Error(`GitHub could not update ${input.head} from ${input.base} (${e.message.trim()}) \u2014 ${remedy}`);
+  }
+  const sleep2 = input.sleep ?? ((ms) => new Promise((resolve7) => setTimeout(resolve7, ms)));
+  for (let attempt = 0; attempt < PR_HEAD_UPDATE_API_READ_RETRIES; attempt++) {
+    const to = await readHead2();
+    if (to && to !== from) return { from, to, base: input.base, via: "update-branch-api" };
+    await sleep2(PR_HEAD_UPDATE_API_READ_DELAY_MS);
+  }
+  throw new Error(`GitHub accepted the update of ${input.head} from ${input.base} but the head did not move \u2014 check the PR, then rerun`);
+}
 var PR_LAND_POLL_MS = 3e4;
 var PR_LAND_ENQUEUE_TIMEOUT_MS = 10 * 6e4;
 var PR_LAND_STATE_READ_RETRIES = 3;
@@ -36076,21 +36147,30 @@ async function runPrLand(prNumber, options, deps) {
   }
   const ciPolicy = await deps.resolveCiPolicy(repo);
   base.ciPolicy = ciPolicy;
-  const checksWait = await deps.waitForChecks(prNumber, repo);
-  base.checksWait = checksWait;
-  if (checksWait.status === "conflicting") {
-    return {
-      ...base,
-      error: `checks-wait conflicting: ${checksWait.reason ?? "PR is conflicting with the base branch"}`
-    };
-  }
-  if (checksWait.status === "failure" || checksWait.status === "timeout" || checksWait.status === "rate-limited") {
-    return {
-      ...base,
-      error: `checks-wait ${checksWait.status}${checksWait.detail ? `: ${checksWait.detail}` : ""}`
-    };
+  const checksWaitError = (checksWait) => {
+    if (checksWait.status === "conflicting") {
+      return `checks-wait conflicting: ${checksWait.reason ?? "PR is conflicting with the base branch"}`;
+    }
+    if (checksWait.status === "failure" || checksWait.status === "timeout" || checksWait.status === "rate-limited") {
+      return `checks-wait ${checksWait.status}${checksWait.detail ? `: ${checksWait.detail}` : ""}`;
+    }
+    return void 0;
+  };
+  base.checksWait = await deps.waitForChecks(prNumber, repo);
+  const waitError = checksWaitError(base.checksWait);
+  if (waitError) return { ...base, error: waitError };
+  let prState = await deps.readPrState(prNumber, repo);
+  if (prState.mergeStateStatus === "BEHIND" && deps.updateBranch) {
+    try {
+      base.branchUpdated = await deps.updateBranch(prNumber, repo);
+    } catch (e) {
+      return { ...base, error: `pr land #${prNumber}: ${e.message}` };
+    }
+    base.checksWait = await deps.waitForChecks(prNumber, repo);
+    const reWaitError = checksWaitError(base.checksWait);
+    if (reWaitError) return { ...base, error: reWaitError };
+    prState = await deps.readPrState(prNumber, repo);
   }
-  const prState = await deps.readPrState(prNumber, repo);
   if (prState.mergeStateStatus === "DIRTY" || prState.mergeable === "CONFLICTING") {
     return {
       ...base,
@@ -37581,15 +37661,193 @@ function postMergeReconWarnings(input) {
   return lines2;
 }
 
-// src/pr-create-docs-check.ts
+// src/review-verdict.ts
 var import_node_child_process14 = require("node:child_process");
+var import_node_fs39 = require("node:fs");
+var import_node_os19 = require("node:os");
+var import_node_path36 = require("node:path");
+var REVIEW_VERDICT_MARKER = "<!-- zeroci-review v1 -->";
+var REVIEW_WAIVER_MARKER = "<!-- zeroci-review-waived v1 -->";
+var REVIEW_VERDICTS = ["PROCEED", "CORRECT", "ESCALATE"];
+function isReviewVerdict(value) {
+  return typeof value === "string" && REVIEW_VERDICTS.includes(value);
+}
+function renderReviewVerdictComment(input) {
+  const payload = {
+    v: 1,
+    patch: input.patch,
+    head: input.head,
+    verdict: input.verdict,
+    scope: input.scope,
+    risk: input.risk,
+    unverified: input.unverified,
+    reviewer: input.reviewer
+  };
+  const findings = input.findings?.trim();
+  return `${REVIEW_VERDICT_MARKER}
+\`\`\`json
+${JSON.stringify(payload, null, 2)}
+\`\`\`
+${findings ? `
+${findings}
+` : ""}`;
+}
+function isReviewVerdictComment(body) {
+  return body.trimStart().startsWith(REVIEW_VERDICT_MARKER);
+}
+var FENCE_RE = /^(?:`{3,}|~{3,})[^\n]*\n([\s\S]*?)\n(?:`{3,}|~{3,})\s*$/m;
+function parseReviewVerdictComment(body) {
+  if (!isReviewVerdictComment(body)) return void 0;
+  const rest = body.trimStart().slice(REVIEW_VERDICT_MARKER.length);
+  const fence = FENCE_RE.exec(rest);
+  if (!fence) return void 0;
+  let parsed;
+  try {
+    parsed = JSON.parse(fence[1]);
+  } catch {
+    return void 0;
+  }
+  if (!parsed || typeof parsed !== "object") return void 0;
+  const p = parsed;
+  if (p.v !== 1 || !isReviewVerdict(p.verdict)) return void 0;
+  if (typeof p.patch !== "string" || !/^[0-9a-f]{40}$/.test(p.patch)) return void 0;
+  if (typeof p.head !== "string" || typeof p.scope !== "string" || typeof p.risk !== "string" || typeof p.reviewer !== "string") return void 0;
+  const unverified = Array.isArray(p.unverified) ? p.unverified.filter((u) => typeof u === "string") : [];
+  return { v: 1, patch: p.patch, head: p.head, verdict: p.verdict, scope: p.scope, risk: p.risk, unverified, reviewer: p.reviewer };
+}
+function evaluateReviewVerdict(comments, currentPatchId) {
+  let latest;
+  for (const c of comments) {
+    if (!isReviewVerdictComment(c.body)) continue;
+    if (!latest || c.createdAt >= latest.createdAt) latest = c;
+  }
+  if (!latest) return { ok: false, reason: "none" };
+  const payload = parseReviewVerdictComment(latest.body);
+  if (!payload) return { ok: false, reason: "malformed" };
+  if (payload.verdict !== "PROCEED") return { ok: false, reason: "not-proceed", verdict: payload.verdict, patch: payload.patch };
+  if (payload.patch !== currentPatchId) return { ok: false, reason: "stale", verdict: payload.verdict, patch: payload.patch };
+  return { ok: true, reason: "proceed", verdict: payload.verdict, patch: payload.patch };
+}
+function reviewVerdictRemedyCommand(number, repo) {
+  return `mmi-cli devops pr review-verdict ${number} --repo ${repo} --verdict PROCEED --scope "<one line>" --risk "<one line>" --reviewer <seat-or-model-id>`;
+}
+function reviewVerdictRefusalMessage(context, number, repo, evaluation, currentPatchId) {
+  const why = {
+    none: "no review verdict comment on the PR",
+    stale: `the latest verdict is bound to patch ${evaluation.patch} but the PR's current diff is ${currentPatchId} \u2014 the content changed since the review`,
+    "not-proceed": `the latest verdict is ${evaluation.verdict}, not PROCEED`,
+    malformed: "the latest verdict comment is malformed (marker present, JSON block unreadable or wrong shape)",
+    proceed: "proceed"
+  }[evaluation.reason];
+  return `${context}: REVIEW VERDICT REQUIRED (#6255) \u2014 ${why}. Review PR #${number} and post the verdict, then rerun:
+  ${reviewVerdictRemedyCommand(number, repo)}
+To land without a review, pass --without-review "<reason>" \u2014 it posts a waiver comment on the PR.`;
+}
+function renderReviewWaiverComment(reason, actor) {
+  return `${REVIEW_WAIVER_MARKER}
+Review gate waived by @${actor}: ${reason.trim()}
+`;
+}
+function computePrPatchId(number, repo) {
+  return new Promise((resolve7, reject) => {
+    const gh = (0, import_node_child_process14.spawn)("gh", ["pr", "diff", number, "--repo", repo], { windowsHide: true, stdio: ["ignore", "pipe", "pipe"] });
+    const git3 = (0, import_node_child_process14.spawn)("git", ["patch-id", "--stable"], { windowsHide: true, stdio: ["pipe", "pipe", "pipe"] });
+    let out = "";
+    let ghErr = "";
+    let gitErr = "";
+    const timer = setTimeout(() => {
+      gh.kill();
+      git3.kill();
+      reject(new Error(`patch-id: timed out after ${GC_GH_TIMEOUT_MS4}ms`));
+    }, GC_GH_TIMEOUT_MS4);
+    gh.stdout.pipe(git3.stdin);
+    gh.stderr.on("data", (d) => {
+      ghErr += d.toString();
+    });
+    git3.stderr.on("data", (d) => {
+      gitErr += d.toString();
+    });
+    git3.stdout.on("data", (d) => {
+      out += d.toString();
+    });
+    gh.on("error", (e) => {
+      clearTimeout(timer);
+      reject(e);
+    });
+    git3.on("error", (e) => {
+      clearTimeout(timer);
+      reject(e);
+    });
+    let ghCode;
+    gh.on("close", (code) => {
+      ghCode = code;
+    });
+    git3.on("close", (code) => {
+      clearTimeout(timer);
+      if (ghCode) return reject(Object.assign(new Error(`gh pr diff ${number} --repo ${repo} exited ${ghCode}: ${ghErr.trim()}`), { stderr: ghErr }));
+      if (code) return reject(new Error(`git patch-id --stable exited ${code}: ${gitErr.trim()}`));
+      const id = out.trim().split(/\s+/)[0];
+      if (!/^[0-9a-f]{40}$/.test(id ?? "")) return reject(new Error(`patch-id: PR #${number} diff is empty or unreadable (gh: ${ghErr.trim() || "no stderr"})`));
+      resolve7(id);
+    });
+  });
+}
+async function readPrHeadSha(number, repo) {
+  const { stdout } = await execFileP("gh", ["api", `repos/${repo}/pulls/${number}`, "--jq", ".head.sha"], { timeout: GC_GH_TIMEOUT_MS4 });
+  const sha = stdout.trim();
+  if (!/^[0-9a-f]{40}$/.test(sha)) throw new Error(`could not read PR #${number} head sha`);
+  return sha;
+}
+async function readPrIssueComments(number, repo) {
+  const { stdout } = await execFileP("gh", ["api", "--paginate", `repos/${repo}/issues/${number}/comments?per_page=100`, "--jq", ".[] | {body, createdAt: .created_at}"], { timeout: GC_GH_TIMEOUT_MS4 });
+  return parseNdjsonLines(stdout);
+}
+async function postPrCommentFromFile(number, repo, body) {
+  const dir = (0, import_node_fs39.mkdtempSync)((0, import_node_path36.join)((0, import_node_os19.tmpdir)(), "mmi-review-verdict-"));
+  const path2 = (0, import_node_path36.join)(dir, "body.md");
+  try {
+    (0, import_node_fs39.writeFileSync)(path2, body, "utf8");
+    const { stdout } = await execFileP("gh", ["pr", "comment", number, "--repo", repo, "--body-file", path2], { timeout: GH_MUTATION_TIMEOUT_MS });
+    return stdout.trim();
+  } finally {
+    try {
+      (0, import_node_fs39.rmSync)(dir, { recursive: true, force: true });
+    } catch {
+    }
+  }
+}
+async function requireReviewVerdict(context, number, repo, opts) {
+  if (opts.withoutReview !== void 0) {
+    const reason = opts.withoutReview.trim();
+    if (!reason) throw new Error(`${context}: --without-review needs a non-empty reason`);
+    const actor = await execFileP("gh", ["api", "user", "--jq", ".login"], { timeout: GC_GH_TIMEOUT_MS4 }).then((r) => r.stdout.trim()).catch(() => "") || "unknown";
+    await postPrCommentFromFile(number, repo, renderReviewWaiverComment(reason, actor));
+    console.warn(`${context}: review gate WAIVED by @${actor} \u2014 ${reason} (waiver comment posted on PR #${number})`);
+    return void 0;
+  }
+  let comments;
+  let currentPatchId;
+  try {
+    [comments, currentPatchId] = await Promise.all([readPrIssueComments(number, repo), computePrPatchId(number, repo)]);
+  } catch (e) {
+    const detail = e.message || String(e);
+    const limited = isGitHubRateLimitError(e) ? " (gh rate-limited \u2014 retry after the pool resets)" : "";
+    throw new Error(`${context}: cannot read PR #${number}'s review verdict${limited} \u2014 ${detail}. Refusing to merge WITHOUT the review gate (#6255).`);
+  }
+  const evaluation = evaluateReviewVerdict(comments, currentPatchId);
+  if (evaluation.ok) return void 0;
+  return reviewVerdictRefusalMessage(context, number, repo, evaluation, currentPatchId);
+}
+
+// src/pr-create-docs-check.ts
+var import_node_child_process15 = require("node:child_process");
 var GIT_TIMEOUT_MS2 = 15e3;
 function catFileBatch(root, ref, paths) {
   if (paths.length === 0) return Promise.resolve([]);
   return new Promise((resolve7) => {
     const chunks = [];
     let settled = false;
-    const child2 = (0, import_node_child_process14.spawn)("git", ["-C", root, "cat-file", "--batch", "--buffer"], { windowsHide: true });
+    const child2 = (0, import_node_child_process15.spawn)("git", ["-C", root, "cat-file", "--batch", "--buffer"], { windowsHide: true });
     const finish = () => {
       if (settled) return;
       settled = true;
@@ -37759,26 +38017,26 @@ async function prCreateClaimRefusal(body, repoOption, deps = {}) {
 }
 
 // src/worktree-merge-cleanup.ts
-var import_node_fs41 = require("node:fs");
-var import_node_path38 = require("node:path");
+var import_node_fs42 = require("node:fs");
+var import_node_path39 = require("node:path");
 
 // src/jervcode-node-modules-cleanup.ts
-var import_node_fs39 = require("node:fs");
-var import_node_os19 = require("node:os");
-var import_node_path36 = require("node:path");
-var JERVCODE_PACKAGE_ENTRY = (0, import_node_path36.join)("node_modules", "@jervaise", "jervcode", "dist", "launcher-entry.js");
+var import_node_fs40 = require("node:fs");
+var import_node_os20 = require("node:os");
+var import_node_path37 = require("node:path");
+var JERVCODE_PACKAGE_ENTRY = (0, import_node_path37.join)("node_modules", "@jervaise", "jervcode", "dist", "launcher-entry.js");
 var WIN_NAMES2 = ["jervcode.cmd", "jervcode"];
 var POSIX_NAMES2 = ["jervcode"];
 var NODE_MODULES_CLEANUP_TIMEOUT_MS = 3e5;
-function jervcodeCandidatePaths(env = process.env, home = (0, import_node_os19.homedir)(), platform2 = process.platform) {
+function jervcodeCandidatePaths(env = process.env, home = (0, import_node_os20.homedir)(), platform2 = process.platform) {
   const names = platform2 === "win32" ? WIN_NAMES2 : POSIX_NAMES2;
   const out = [];
   for (const dir of jervCliCandidateDirs(env, home, platform2)) {
-    for (const name of names) out.push((0, import_node_path36.join)(dir, name));
+    for (const name of names) out.push((0, import_node_path37.join)(dir, name));
   }
   return out;
 }
-function resolveJervcodePath(env = process.env, home = (0, import_node_os19.homedir)(), platform2 = process.platform, exists = import_node_fs39.existsSync) {
+function resolveJervcodePath(env = process.env, home = (0, import_node_os20.homedir)(), platform2 = process.platform, exists = import_node_fs40.existsSync) {
   for (const candidate of jervcodeCandidatePaths(env, home, platform2)) {
     if (exists(candidate)) return candidate;
   }
@@ -37786,10 +38044,10 @@ function resolveJervcodePath(env = process.env, home = (0, import_node_os19.home
 }
 function jervcodeExecFileArgs(args, opts = {}) {
   const platform2 = opts.platform ?? process.platform;
-  const exists = opts.exists ?? import_node_fs39.existsSync;
-  const resolved = resolveJervcodePath(opts.env ?? process.env, opts.home ?? (0, import_node_os19.homedir)(), platform2, exists);
+  const exists = opts.exists ?? import_node_fs40.existsSync;
+  const resolved = resolveJervcodePath(opts.env ?? process.env, opts.home ?? (0, import_node_os20.homedir)(), platform2, exists);
   if (resolved) {
-    const entry = (0, import_node_path36.join)((0, import_node_path36.join)(resolved, ".."), JERVCODE_PACKAGE_ENTRY);
+    const entry = (0, import_node_path37.join)((0, import_node_path37.join)(resolved, ".."), JERVCODE_PACKAGE_ENTRY);
     if (exists(entry)) {
       return { file: opts.execPath ?? process.execPath, args: [entry, ...args], via: "node-entry" };
     }
@@ -37820,8 +38078,8 @@ async function removeWorktreeNodeModulesViaHelper(wtPath, opts = {}) {
 }
 
 // src/worktree-evidence-archive.ts
-var import_node_fs40 = require("node:fs");
-var import_node_path37 = require("node:path");
+var import_node_fs41 = require("node:fs");
+var import_node_path38 = require("node:path");
 var JERV_ARTIFACT_RUN_SCOPE_ENV_VARS = ["JERV_RUN_ID", ...SESSION_ID_ENV_VARS];
 function sanitizeArchiveSegment(value, max = 80) {
   const scrubbed = value.replace(/[^A-Za-z0-9._@+-]+/g, "-").replace(/^-+|-+$/g, "");
@@ -37836,24 +38094,24 @@ function resolveArtifactRunScope(env = process.env) {
 }
 function defaultIsDirectory(path2) {
   try {
-    return (0, import_node_fs40.lstatSync)(path2).isDirectory();
+    return (0, import_node_fs41.lstatSync)(path2).isDirectory();
   } catch {
     return false;
   }
 }
 function archiveWorktreeJervArtifacts(args, deps = {}) {
-  const exists = deps.exists ?? import_node_fs40.existsSync;
+  const exists = deps.exists ?? import_node_fs41.existsSync;
   const isDirectory = deps.isDirectory ?? defaultIsDirectory;
-  const copyDir = deps.copyDir ?? ((from, to) => (0, import_node_fs40.cpSync)(from, to, { recursive: true, force: true }));
+  const copyDir = deps.copyDir ?? ((from, to) => (0, import_node_fs41.cpSync)(from, to, { recursive: true, force: true }));
   const mkdirp = deps.mkdirp ?? ((path2) => {
-    (0, import_node_fs40.mkdirSync)(path2, { recursive: true });
+    (0, import_node_fs41.mkdirSync)(path2, { recursive: true });
   });
   const env = deps.env ?? process.env;
   const now = deps.now ?? (() => /* @__PURE__ */ new Date());
   const resolveRoot = deps.resolveArchiveRoot ?? repoRuntimeStatePath;
   if (!args.primaryRoot?.trim()) return { status: "skipped", reason: "missing-primary-root" };
   if (!args.worktreePath?.trim()) return { status: "skipped", reason: "missing-worktree-path" };
-  const source = (0, import_node_path37.join)(args.worktreePath, ".jerv");
+  const source = (0, import_node_path38.join)(args.worktreePath, ".jerv");
   if (!exists(source)) return { status: "absent" };
   if (!isDirectory(source)) return { status: "skipped", reason: "jerv-not-a-directory" };
   const runScope = resolveArtifactRunScope(env);
@@ -37861,7 +38119,7 @@ function archiveWorktreeJervArtifacts(args, deps = {}) {
   const stamp = now().toISOString().replace(/[:.]/g, "-");
   const dest = resolveRoot(args.primaryRoot, "jerv-artifacts", runScope, branchSlug, stamp, ".jerv");
   try {
-    mkdirp((0, import_node_path37.dirname)(dest));
+    mkdirp((0, import_node_path38.dirname)(dest));
     copyDir(source, dest);
     if (!exists(dest)) return { status: "failed", error: `archive write left no directory at ${dest}` };
     return { status: "archived", path: dest, runScope };
@@ -37870,14 +38128,14 @@ function archiveWorktreeJervArtifacts(args, deps = {}) {
   }
 }
 function defaultStat(path2) {
-  const st = (0, import_node_fs40.statSync)(path2);
+  const st = (0, import_node_fs41.statSync)(path2);
   return { mtimeMs: st.mtimeMs, size: st.size, isDirectory: () => st.isDirectory() };
 }
 function scanWorktreeTmpEvidence(worktreePath, newerThanMs, deps = {}) {
-  const exists = deps.exists ?? import_node_fs40.existsSync;
+  const exists = deps.exists ?? import_node_fs41.existsSync;
   const stat4 = deps.stat ?? defaultStat;
-  const readdir2 = deps.readdir ?? import_node_fs40.readdirSync;
-  const tmpRoot = (0, import_node_path37.join)(worktreePath, "tmp");
+  const readdir2 = deps.readdir ?? import_node_fs41.readdirSync;
+  const tmpRoot = (0, import_node_path38.join)(worktreePath, "tmp");
   if (!exists(tmpRoot)) return [];
   const entries = [];
   const walk2 = (dir) => {
@@ -37888,14 +38146,14 @@ function scanWorktreeTmpEvidence(worktreePath, newerThanMs, deps = {}) {
       return;
     }
     for (const name of names) {
-      const full = (0, import_node_path37.join)(dir, name);
+      const full = (0, import_node_path38.join)(dir, name);
       let st;
       try {
         st = stat4(full);
       } catch {
         continue;
       }
-      const relPath = (0, import_node_path37.relative)(worktreePath, full).replace(/\\/g, "/");
+      const relPath = (0, import_node_path38.relative)(worktreePath, full).replace(/\\/g, "/");
       if (st.isDirectory()) {
         if (st.mtimeMs > newerThanMs) entries.push({ relPath, bytes: 0, mtimeMs: st.mtimeMs });
         walk2(full);
@@ -37909,10 +38167,10 @@ function scanWorktreeTmpEvidence(worktreePath, newerThanMs, deps = {}) {
   return entries;
 }
 function archiveWorktreeTmpArtifacts(args, deps = {}) {
-  const exists = deps.exists ?? import_node_fs40.existsSync;
-  const copyDir = deps.copyDir ?? ((from, to) => (0, import_node_fs40.cpSync)(from, to, { recursive: true, force: true }));
+  const exists = deps.exists ?? import_node_fs41.existsSync;
+  const copyDir = deps.copyDir ?? ((from, to) => (0, import_node_fs41.cpSync)(from, to, { recursive: true, force: true }));
   const mkdirp = deps.mkdirp ?? ((path2) => {
-    (0, import_node_fs40.mkdirSync)(path2, { recursive: true });
+    (0, import_node_fs41.mkdirSync)(path2, { recursive: true });
   });
   const env = deps.env ?? process.env;
   const now = deps.now ?? (() => /* @__PURE__ */ new Date());
@@ -37920,7 +38178,7 @@ function archiveWorktreeTmpArtifacts(args, deps = {}) {
   if (!args.primaryRoot?.trim()) return { status: "skipped", reason: "missing-primary-root" };
   if (!args.worktreePath?.trim()) return { status: "skipped", reason: "missing-worktree-path" };
   const scanned = scanWorktreeTmpEvidence(args.worktreePath, args.newerThanMs, deps);
-  const source = (0, import_node_path37.join)(args.worktreePath, "tmp");
+  const source = (0, import_node_path38.join)(args.worktreePath, "tmp");
   if (!scanned.length) return { status: "absent" };
   if (!exists(source)) return { status: "absent" };
   const runScope = resolveArtifactRunScope(env);
@@ -37928,7 +38186,7 @@ function archiveWorktreeTmpArtifacts(args, deps = {}) {
   const stamp = now().toISOString().replace(/[:.]/g, "-");
   const dest = resolveRoot(args.primaryRoot, "worktree-artifacts", runScope, branchSlug, stamp, "tmp");
   try {
-    mkdirp((0, import_node_path37.dirname)(dest));
+    mkdirp((0, import_node_path38.dirname)(dest));
     copyDir(source, dest);
     if (!exists(dest)) return { status: "failed", error: `archive write left no directory at ${dest}` };
     const bytes = scanned.reduce((sum, e) => sum + e.bytes, 0);
@@ -37997,9 +38255,9 @@ function normPath2(p) {
   return p.replace(/\\/g, "/").replace(/\/+$/, "");
 }
 function unlinkNodeModulesJunction(wtPath) {
-  const nm = (0, import_node_path38.join)(wtPath, "node_modules");
+  const nm = (0, import_node_path39.join)(wtPath, "node_modules");
   try {
-    if ((0, import_node_fs41.lstatSync)(nm).isSymbolicLink()) (0, import_node_fs41.rmdirSync)(nm);
+    if ((0, import_node_fs42.lstatSync)(nm).isSymbolicLink()) (0, import_node_fs42.rmdirSync)(nm);
     return { ok: true };
   } catch (e) {
     if (e.code === "ENOENT") return { ok: true };
@@ -38010,8 +38268,8 @@ function defaultSleep2(ms) {
   return new Promise((resolve7) => setTimeout(resolve7, ms));
 }
 async function removeResidueDirectory(wtPath, options = {}) {
-  const { sleep: sleep2 = defaultSleep2, removeEmptyDir = import_node_fs41.rmdirSync, exists = import_node_fs41.existsSync } = options;
-  const removeRecursive = options.removeRecursive ?? ((path2) => (0, import_node_fs41.rmSync)(path2, { recursive: true, force: true, maxRetries: 10, retryDelay: 100 }));
+  const { sleep: sleep2 = defaultSleep2, removeEmptyDir = import_node_fs42.rmdirSync, exists = import_node_fs42.existsSync } = options;
+  const removeRecursive = options.removeRecursive ?? ((path2) => (0, import_node_fs42.rmSync)(path2, { recursive: true, force: true, maxRetries: 10, retryDelay: 100 }));
   const junction = unlinkNodeModulesJunction(wtPath);
   if (!junction.ok) return junction;
   try {
@@ -38134,31 +38392,31 @@ async function preCleanWorktreeForRemoval(wtPath, execGit) {
 }
 async function listNestedIgnoredNodeModules(wtPath, execGit) {
   const out = await execGit(["-C", wtPath, "ls-files", "--others", "--ignored", "--exclude-standard", "--directory"]).catch(() => "");
-  return out.split(/\r?\n/).map((line) => line.trim()).filter((line) => line.endsWith("node_modules/") && line !== "node_modules/").map((line) => (0, import_node_path38.join)(wtPath, line.slice(0, -1)));
+  return out.split(/\r?\n/).map((line) => line.trim()).filter((line) => line.endsWith("node_modules/") && line !== "node_modules/").map((line) => (0, import_node_path39.join)(wtPath, line.slice(0, -1)));
 }
 function safeRemoveTree(path2) {
-  const stat4 = (0, import_node_fs41.lstatSync)(path2);
+  const stat4 = (0, import_node_fs42.lstatSync)(path2);
   if (stat4.isSymbolicLink()) {
     try {
-      (0, import_node_fs41.rmdirSync)(path2);
+      (0, import_node_fs42.rmdirSync)(path2);
     } catch {
-      (0, import_node_fs41.unlinkSync)(path2);
+      (0, import_node_fs42.unlinkSync)(path2);
     }
     return;
   }
   if (stat4.isDirectory()) {
-    for (const entry of (0, import_node_fs41.readdirSync)(path2)) safeRemoveTree((0, import_node_path38.join)(path2, entry));
-    (0, import_node_fs41.rmdirSync)(path2);
+    for (const entry of (0, import_node_fs42.readdirSync)(path2)) safeRemoveTree((0, import_node_path39.join)(path2, entry));
+    (0, import_node_fs42.rmdirSync)(path2);
     return;
   }
-  (0, import_node_fs41.unlinkSync)(path2);
+  (0, import_node_fs42.unlinkSync)(path2);
 }
 function errorMessage(e) {
   return e instanceof Error ? e.message : String(e);
 }
 function resolvedOrRaw(path2) {
   try {
-    return normPath2((0, import_node_fs41.realpathSync)(path2));
+    return normPath2((0, import_node_fs42.realpathSync)(path2));
   } catch {
     return normPath2(path2);
   }
@@ -38166,10 +38424,10 @@ function resolvedOrRaw(path2) {
 function unlinkEscapingReparsePoints(root, primaryRoot) {
   let realRoot;
   try {
-    if ((0, import_node_fs41.lstatSync)(root).isSymbolicLink()) {
+    if ((0, import_node_fs42.lstatSync)(root).isSymbolicLink()) {
       return { ok: false, error: `delete root ${normPath2(root)} is a reparse point resolving to ${resolvedOrRaw(root)}` };
     }
-    realRoot = normPath2((0, import_node_fs41.realpathSync)(root));
+    realRoot = normPath2((0, import_node_fs42.realpathSync)(root));
   } catch (e) {
     if (e.code === "ENOENT") return { ok: true, unlinked: [] };
     return { ok: false, error: `cannot resolve delete root ${normPath2(root)}: ${errorMessage(e)}` };
@@ -38185,16 +38443,16 @@ function unlinkEscapingReparsePoints(root, primaryRoot) {
     const dir = stack.pop();
     let entries;
     try {
-      entries = (0, import_node_fs41.readdirSync)(dir, { withFileTypes: true });
+      entries = (0, import_node_fs42.readdirSync)(dir, { withFileTypes: true });
     } catch (e) {
       return { ok: false, error: `cannot scan ${normPath2(dir)} for reparse points: ${errorMessage(e)}` };
     }
     for (const entry of entries) {
-      const child2 = (0, import_node_path38.join)(dir, entry.name);
+      const child2 = (0, import_node_path39.join)(dir, entry.name);
       if (entry.isSymbolicLink()) {
         let target = "";
         try {
-          target = normPath2((0, import_node_fs41.realpathSync)(child2));
+          target = normPath2((0, import_node_fs42.realpathSync)(child2));
         } catch {
           target = "";
         }
@@ -38224,7 +38482,7 @@ async function describePreCleanFailure(wtPath, execGit, error) {
   const more = remaining.length > 10 ? ` (+${remaining.length - 10} more)` : "";
   const quote = (path2) => path2.replace(/'/g, "''");
   const nested = remaining.find((path2) => path2.endsWith("node_modules/") && path2 !== "node_modules/");
-  const remediation = remaining.includes("node_modules/") ? `jervcode worktree-node-modules-cleanup --worktree '${quote(wtPath)}'` : nested ? `Remove-Item -LiteralPath '${quote((0, import_node_path38.join)(wtPath, nested.slice(0, -1)))}' -Recurse -Force` : void 0;
+  const remediation = remaining.includes("node_modules/") ? `jervcode worktree-node-modules-cleanup --worktree '${quote(wtPath)}'` : nested ? `Remove-Item -LiteralPath '${quote((0, import_node_path39.join)(wtPath, nested.slice(0, -1)))}' -Recurse -Force` : void 0;
   return { ok: false, error: `${error}; remaining ignored paths: ${shown}${more}`, ...remediation ? { remediation } : {} };
 }
 function formatWorktreeRemovalFailureDetail(options) {
@@ -38378,7 +38636,7 @@ async function cleanupPrMergeLocalBranch(branch, options) {
     return report;
   }
   const execGit = options.execGit ?? (async (args) => (await execFileP("git", args, { timeout: GIT_TIMEOUT_MS })).stdout);
-  const pathExists = options.pathExists ?? import_node_fs41.existsSync;
+  const pathExists = options.pathExists ?? import_node_fs42.existsSync;
   let afterWorktrees = [];
   try {
     afterWorktrees = parseGitWorktreePorcelain(await execGit(["worktree", "list", "--porcelain"]));
@@ -38518,7 +38776,7 @@ async function cleanupPrMergeLocalBranch(branch, options) {
   const preHelperGuard = unlinkEscapingReparsePoints(wtPath, options.primaryRoot);
   if (!preHelperGuard.ok) return refuseReparseEscape(preHelperGuard.error);
   unlinkedReparsePoints.push(...preHelperGuard.unlinked);
-  if (pathExists((0, import_node_path38.join)(wtPath, "node_modules"))) {
+  if (pathExists((0, import_node_path39.join)(wtPath, "node_modules"))) {
     const nmRemoved = await (options.removeRealNodeModules ?? ((p) => removeWorktreeNodeModulesViaHelper(p, { cwd: mainWorktreePath })))(wtPath);
     if (!nmRemoved.ok) {
       report.worktree = {
@@ -38685,10 +38943,10 @@ function argvWantsJson2() {
   return process.argv.some((a) => a === "--json" || a.startsWith("--json="));
 }
 function hubRoot() {
-  const fromPkg = (0, import_node_path39.join)(__dirname, "..", "..");
+  const fromPkg = (0, import_node_path40.join)(__dirname, "..", "..");
   const marker = "skills/bootstrap/seeds/manifest.json";
-  if ((0, import_node_fs42.existsSync)((0, import_node_path39.join)(fromPkg, marker))) return fromPkg;
-  if ((0, import_node_fs42.existsSync)((0, import_node_path39.join)(process.cwd(), marker))) return process.cwd();
+  if ((0, import_node_fs43.existsSync)((0, import_node_path40.join)(fromPkg, marker))) return fromPkg;
+  if ((0, import_node_fs43.existsSync)((0, import_node_path40.join)(process.cwd(), marker))) return process.cwd();
   return null;
 }
 function ciAuditDeps() {
@@ -38700,8 +38958,8 @@ function ciAuditDeps() {
     getProjectMeta: async (slug) => fetchProjectBySlug(slug, registryClientDeps(await cfgPromise)),
     readSeedFile: (path2) => {
       if (!root) return null;
-      const fullPath = (0, import_node_path39.join)(root, path2);
-      return (0, import_node_fs42.existsSync)(fullPath) ? (0, import_node_fs42.readFileSync)(fullPath, "utf8") : null;
+      const fullPath = (0, import_node_path40.join)(root, path2);
+      return (0, import_node_fs43.existsSync)(fullPath) ? (0, import_node_fs43.readFileSync)(fullPath, "utf8") : null;
     }
   };
 }
@@ -38783,7 +39041,7 @@ function scheduleRelatedDiscovery(o) {
   try {
     const args = ["issue", "discover-related", "--number", String(o.number), "--title", o.title, "--body", o.body, "--fail-soft"];
     if (o.repo) args.push("--repo", o.repo);
-    spawnDetachedSelf(args, { spawn: import_node_child_process15.spawn, execPath: process.execPath, scriptPath: process.argv[1] }, { cwd: process.cwd() });
+    spawnDetachedSelf(args, { spawn: import_node_child_process16.spawn, execPath: process.execPath, scriptPath: process.argv[1] }, { cwd: process.cwd() });
   } catch {
   }
 }
@@ -39344,11 +39602,11 @@ ${list}`);
     }
   });
   async function listCiWorkflowPaths(cwd = process.cwd()) {
-    const wfDir = (0, import_node_path39.join)(cwd, ".github", "workflows");
-    if (!(0, import_node_fs42.existsSync)(wfDir)) return [];
-    return (0, import_node_fs42.readdirSync)(wfDir).filter((name) => /\.(ya?ml)$/i.test(name)).filter((name) => {
+    const wfDir = (0, import_node_path40.join)(cwd, ".github", "workflows");
+    if (!(0, import_node_fs43.existsSync)(wfDir)) return [];
+    return (0, import_node_fs43.readdirSync)(wfDir).filter((name) => /\.(ya?ml)$/i.test(name)).filter((name) => {
       try {
-        return workflowReportsPrChecks((0, import_node_fs42.readFileSync)((0, import_node_path39.join)(wfDir, name), "utf8"));
+        return workflowReportsPrChecks((0, import_node_fs43.readFileSync)((0, import_node_path40.join)(wfDir, name), "utf8"));
       } catch {
         return true;
       }
@@ -39536,7 +39794,49 @@ ${list}`);
     if (result.status === "failure" || result.status === "conflicting") process.exitCode = 1;
     if (result.status === "timeout" || result.status === "rate-limited") process.exitCode = PR_CHECKS_TIMEOUT_EXIT_CODE;
   });
-  pr.command("land <number>").description("agent merge path (#1440): train probe \u2014 checks-wait \u2014 merge --auto \u2014 poll enqueued \u2014 development PRs only").option("--json", "machine-readable output").option("--repo <owner/repo>", "target repo (defaults to the PR repo)").option("--no-require-train", "skip train-authority preflight (not recommended for autonomous agents)").option("--force", "acknowledge and land past a remaining prunable/severe scratch housekeeping block (advisory kept plans/ never blocks, #3012) or a negated-closing-keyword (#3718) or ambiguous-cross-repo-closing (#4279) refusal").action(async (number, o) => {
+  jsonParity(pr.command("review-verdict <number>").description("post the ZeroCI review verdict comment the merge helper requires (#6255): computes the PR diff patch-id and head sha itself, renders the v1 contract body, posts it as a PR comment. Only a PROCEED bound to the CURRENT diff lets `pr merge` / `pr land` merge").requiredOption("--repo <owner/repo>", "target repo").requiredOption("--verdict <verdict>", `one of ${REVIEW_VERDICTS.join("|")}`).requiredOption("--scope <text>", "one line: what was reviewed").requiredOption("--risk <text>", "one line: the residual risk").option("--unverified <text>", "a claim the reviewer could not verify (repeatable)", (v, acc) => [...acc, v], []).requiredOption("--reviewer <id>", "reviewer seat or model id").option("--findings-file <path>", "Markdown findings appended after the JSON block")).action(async (number, o) => {
+    if (!isReviewVerdict(o.verdict)) return fail(`pr review-verdict: --verdict must be one of ${REVIEW_VERDICTS.join("|")} (got ${o.verdict})`);
+    const verdict = o.verdict;
+    const findings = o.findingsFile ? (0, import_node_fs43.readFileSync)(o.findingsFile, "utf8") : void 0;
+    let patch;
+    let head;
+    try {
+      [patch, head] = await Promise.all([computePrPatchId(number, o.repo), readPrHeadSha(number, o.repo)]);
+    } catch (e) {
+      return failGraceful(`pr review-verdict: ${e.message}`);
+    }
+    const body = renderReviewVerdictComment({ v: 1, patch, head, verdict, scope: o.scope, risk: o.risk, unverified: o.unverified, reviewer: o.reviewer, findings });
+    let commentUrl;
+    try {
+      commentUrl = await postPrCommentFromFile(number, o.repo, body);
+    } catch (e) {
+      const err = e;
+      return failGraceful(`pr review-verdict: ${(err.stderr || err.message || String(e)).trim()}`);
+    }
+    printLine(JSON.stringify({ number: Number(number), repo: o.repo, verdict, patch, head, commentUrl }));
+  });
+  async function updatePrHeadForMerge(input) {
+    return updatePrHeadFromBase({
+      ...input,
+      git: async (args) => (await execFileP("git", args, { timeout: GIT_TIMEOUT_MS })).stdout,
+      rest: (method, path2, body) => defaultGitHubClient().rest(method, path2, { ...body ? { body } : {}, timeoutMs: GH_MUTATION_TIMEOUT_MS })
+    });
+  }
+  async function prHeadCheckedOutHere(head, repo, explicitRepo) {
+    if (await gitOut(["branch", "--show-current"]) !== head) return false;
+    if (!explicitRepo || !repo) return true;
+    const cwdRepo = repoFromRemoteUrl(await gitOut(["remote", "get-url", "origin"]));
+    return cwdRepo?.toLowerCase() === repo.split("/").slice(-2).join("/").toLowerCase();
+  }
+  async function prLandUpdateBranch(prNumber, repo, explicitRepo) {
+    const viewed = JSON.parse((await execFileP("gh", ["pr", "view", prNumber, "--repo", repo, "--json", "headRefName,baseRefName"], { timeout: GC_GH_TIMEOUT_MS4 })).stdout);
+    const localCheckedOut = await prHeadCheckedOutHere(viewed.headRefName, repo, explicitRepo);
+    console.warn(`pr land: PR #${prNumber} is BEHIND ${viewed.baseRefName} \u2014 updating ${viewed.headRefName} from the base (${localCheckedOut ? "local merge commit + push" : "GitHub update-branch"}) and re-waiting the checks once (#6263).`);
+    return updatePrHeadForMerge({ prNumber, repo, head: viewed.headRefName, base: viewed.baseRefName, localCheckedOut });
+  }
+  class PrHeadBehindBaseError extends Error {
+  }
+  pr.command("land <number>").description("agent merge path (#1440): train probe \u2014 checks-wait \u2014 merge --auto \u2014 poll enqueued \u2014 development PRs only").option("--json", "machine-readable output").option("--repo <owner/repo>", "target repo (defaults to the PR repo)").option("--no-require-train", "skip train-authority preflight (not recommended for autonomous agents)").option("--force", "acknowledge and land past a remaining prunable/severe scratch housekeeping block (advisory kept plans/ never blocks, #3012) or a negated-closing-keyword (#3718) or ambiguous-cross-repo-closing (#4279) refusal").option("--without-review <reason>", "land without a review verdict (#6255): posts a `zeroci-review-waived` comment carrying the reason and actor, then proceeds").action(async (number, o) => {
     if (/^(?:[^/]+\/[^/]+)?#\d+$/.test(number.trim())) {
       try {
         const parsed = parseIssueRef(number, o.repo);
@@ -39571,6 +39871,15 @@ ${list}`);
       return;
     }
     if (landClosingGuardVerdict.message) console.warn(landClosingGuardVerdict.message);
+    {
+      const gateRepo = landRepoForGuard ?? await requireRepo(o.repo);
+      const refusal = await requireReviewVerdict("pr land", number, gateRepo, { withoutReview: o.withoutReview });
+      if (refusal) {
+        console.error(refusal);
+        process.exitCode = 1;
+        return;
+      }
+    }
     const result = await runPrLand(number, { repo: o.repo, requireTrain: o.requireTrain !== false }, {
       resolveRepo: async (prNumber, repoOpt) => {
         const args = repoOpt ? ["--repo", repoOpt] : repoArgs;
@@ -39645,6 +39954,7 @@ ${list}`);
         allowedClosing: landClosingGuardInput?.closing,
         bodyText: landSquashBody
       }),
+      updateBranch: (prNumber, repo) => prLandUpdateBranch(prNumber, repo, Boolean(o.repo)),
       pollMerged: async (prNumber, repo, deadlineMs) => {
         let lastFailure;
         while (Date.now() < deadlineMs) {
@@ -39705,7 +40015,7 @@ ${list}`);
     else printLine(`pr land: ${result.status}${result.error ? ` \u2014 ${result.error}` : ""}`);
     if (result.status === "failed") process.exitCode = 1;
   });
-  jsonParity(pr.command("merge <number>").description("merge a PR (squash by default); archives gitignored tmp/** before worktree teardown; on no-ci repos run pr ci-policy / checks-wait first (#1432, #5679)").option("--squash", "squash merge (default)").option("--merge", "create a merge commit").option("--rebase", "rebase merge").option("--repo <owner/repo>", "target repo (defaults to the current repo); from a foreign checkout the remote probe/delete address this repo and local cleanup runs only in the verified sibling checkout ../<repo>, else localBranch reports skipped-foreign-cwd and the receipt carries foreignCwd: true (#6148)").option("--auto", "enable auto-merge \u2014 merge once the base-branch policy is satisfied (use for policy-gated repos)").addOption(new Option("--disable-auto", "disable a queued auto-merge without merging").conflicts(["auto", "wait", "squash", "merge", "rebase", "preserveWorktree", "gc", "squashBodyFile", "force"])).option("--wait", `wait for checks to reach a terminal passing verdict before merging (default budget ${PR_CHECKS_TIMEOUT_MS / 6e4}m) \u2014 run as a background/monitor task or under a shell timeout above that budget; a short foreground timeout (e.g. 120s) kills it after checks pass and leaves the PR open (#6027)`).option("--preserve-worktree", "after merge, keep the local PR worktree/branch for an active batch (#1888); also the merge settings-proof bypass when delete_branch_on_merge cannot be proven (#6210)").option("--gc", "acknowledge deleting unarchived gitignored tmp/** evidence newer than the branch base (#5679)").option("--squash-body-file <path>", "squash commit body (overrides GitHub COMMIT_MESSAGES); use when a pushed commit mentions close/fix/resolve + #N that must not close (#5723)").option("--force", "acknowledge and merge past a remaining prunable/severe scratch housekeeping block (advisory kept plans/ never blocks, #3012) or a negated-closing-keyword (#3718) or ambiguous-cross-repo-closing (#4279) refusal")).action(async (number, o) => {
+  jsonParity(pr.command("merge <number>").description("merge a PR (squash by default); archives gitignored tmp/** before worktree teardown; on no-ci repos run pr ci-policy / checks-wait first (#1432, #5679)").option("--squash", "squash merge (default)").option("--merge", "create a merge commit").option("--rebase", "rebase merge").option("--repo <owner/repo>", "target repo (defaults to the current repo); from a foreign checkout the remote probe/delete address this repo and local cleanup runs only in the verified sibling checkout ../<repo>, else localBranch reports skipped-foreign-cwd and the receipt carries foreignCwd: true (#6148)").option("--auto", "enable auto-merge \u2014 merge once the base-branch policy is satisfied (use for policy-gated repos)").addOption(new Option("--disable-auto", "disable a queued auto-merge without merging").conflicts(["auto", "wait", "squash", "merge", "rebase", "preserveWorktree", "gc", "squashBodyFile", "force"])).option("--wait", `wait for checks to reach a terminal passing verdict before merging (default budget ${PR_CHECKS_TIMEOUT_MS / 6e4}m) \u2014 run as a background/monitor task or under a shell timeout above that budget; a short foreground timeout (e.g. 120s) kills it after checks pass and leaves the PR open (#6027)`).option("--preserve-worktree", "after merge, keep the local PR worktree/branch for an active batch (#1888); also the merge settings-proof bypass when delete_branch_on_merge cannot be proven (#6210)").option("--gc", "acknowledge deleting unarchived gitignored tmp/** evidence newer than the branch base (#5679)").option("--squash-body-file <path>", "squash commit body (overrides GitHub COMMIT_MESSAGES); use when a pushed commit mentions close/fix/resolve + #N that must not close (#5723)").option("--force", "acknowledge and merge past a remaining prunable/severe scratch housekeeping block (advisory kept plans/ never blocks, #3012) or a negated-closing-keyword (#3718) or ambiguous-cross-repo-closing (#4279) refusal").option("--without-review <reason>", "merge without a review verdict (#6255): posts a `zeroci-review-waived` comment carrying the reason and actor, then proceeds")).action(async (number, o) => {
     const method = o.rebase ? "--rebase" : o.merge ? "--merge" : "--squash";
     const repoArgs = o.repo ? ["--repo", o.repo] : [];
     if (o.disableAuto) {
@@ -39743,7 +40053,7 @@ ${list}`);
     const mergeSquashBody = squashBodyTextForMerge(
       closingGuardInput,
       method === "--squash",
-      o.squashBodyFile ? (0, import_node_fs42.readFileSync)(o.squashBodyFile, "utf8") : void 0
+      o.squashBodyFile ? (0, import_node_fs43.readFileSync)(o.squashBodyFile, "utf8") : void 0
     );
     if (!o.squashBodyFile) warnSquashBodyClosingStrip("pr merge", closingGuardInput, mergeSquashBody);
     const closingGuardVerdict = evaluateClosingGuard(closingGuardInput, {
@@ -39757,6 +40067,15 @@ ${list}`);
       return;
     }
     if (closingGuardVerdict.message) console.warn(closingGuardVerdict.message);
+    if (prMeta.state !== "MERGED") {
+      const gateRepo = repoForPostCleanup ?? await requireRepo(o.repo);
+      const refusal = await requireReviewVerdict("pr merge", number, gateRepo, { withoutReview: o.withoutReview });
+      if (refusal) {
+        console.error(refusal);
+        process.exitCode = 1;
+        return;
+      }
+    }
     if (prMeta.state !== "MERGED" && !o.preserveWorktree) {
       if (!repoForPostCleanup) throw new Error("pr merge: repository is unreadable; cannot prove remote branch preservation");
       const repoSettings = await fetchRestRepoMergeSettings(repoForPostCleanup);
@@ -39775,7 +40094,7 @@ ${list}`);
     const remote = foreignCwd ? `https://github.com/${targetRepo2}.git` : "origin";
     let foreignCheckout;
     if (foreignCwd) {
-      const sibling = (0, import_node_path39.join)((0, import_node_path39.dirname)(beforeWorktrees[0]?.path || startingPath || process.cwd()), targetRepo2.split("/")[1]);
+      const sibling = (0, import_node_path40.join)((0, import_node_path40.dirname)(beforeWorktrees[0]?.path || startingPath || process.cwd()), targetRepo2.split("/")[1]);
       const siblingRepo = repoFromRemoteUrl(await gitOut(["-C", sibling, "remote", "get-url", "origin"]).catch(() => ""));
       if (siblingRepo?.toLowerCase() === targetRepo2.toLowerCase()) {
         const siblingWorktrees = await execFileP("git", ["-C", sibling, "worktree", "list", "--porcelain"], { timeout: GIT_TIMEOUT_MS }).then((r) => parseGitWorktreePorcelain(r.stdout)).catch(() => void 0);
@@ -39787,7 +40106,7 @@ ${list}`);
     }
     const ciHeadRef = repoForPostCleanup ? await prHeadRefForCiProbe(number, repoForPostCleanup) : void 0;
     const ciPolicy = await resolveMergeCiPolicyForCheckout(o.repo, ciHeadRef);
-    if (o.wait) {
+    const runWaitGate = async () => {
       console.warn(`pr merge: --wait can hold the shell up to the full ${PR_CHECKS_TIMEOUT_MS / 6e4}m budget plus the merge \u2014 run under a shell timeout above that budget or as a background/monitor task (#6027)`);
       const repo = await requireRepo(o.repo);
       const budgetMs = PR_CHECKS_TIMEOUT_MS;
@@ -39799,7 +40118,7 @@ ${list}`);
       if (snapshotRead.state === "failed") {
         console.error(`pr merge: cannot resolve PR #${number}'s base branch \u2014 ${snapshotRead.error}. Refusing to wait against an assumed base; retry when the API answers.`);
         process.exitCode = 1;
-        return;
+        return false;
       }
       const baseBranch = snapshotRead.snapshot.baseRef;
       const requiredContexts = await fetchRequiredCheckContexts(repo, baseBranch).catch(() => null);
@@ -39834,9 +40153,11 @@ ${list}`);
         console.warn(`pr merge: --wait stopped before merge \u2014 ${wait.status}${wait.reason ? `: ${wait.reason}` : ""}${wait.detail ? ` (${wait.detail})` : ""}`);
         for (const line of failedChecksReceiptLines("pr merge", wait)) console.warn(line);
         process.exitCode = wait.status === "timeout" || wait.status === "rate-limited" ? PR_CHECKS_TIMEOUT_EXIT_CODE : 1;
-        return;
+        return false;
       }
-    }
+      return true;
+    };
+    if (o.wait && !await runWaitGate()) return;
     if (ciPolicy.policy === "no-ci") {
       const guard = decidePrMergeNoCiGuard(await pollGhPrChecks(number, repoArgs), ciPolicy.reason);
       if (guard.action === "refuse") throw new Error(`gh pr merge ${number}: ${guard.message}`);
@@ -39852,73 +40173,90 @@ ${list}`);
       { allowedClosing: method === "--squash" ? closingGuardInput?.closing : void 0 }
     );
     const bodyFile = overrideBody?.path;
-    try {
-      await execFileP("gh", buildPrMergeArgs({ number, repoArgs, method, auto: o.auto, deleteBranch: false, bodyFile }), { timeout: GH_MUTATION_TIMEOUT_MS }).catch(async (e) => {
-        const message2 = String(e.message || "");
-        if (/already been merged/i.test(message2)) {
-          remoteNotAttemptedReason = "pr-already-merged";
-          return;
+    let branchUpdated;
+    const mergeOnce = () => execFileP("gh", buildPrMergeArgs({ number, repoArgs, method, auto: o.auto, deleteBranch: false, bodyFile }), { timeout: GH_MUTATION_TIMEOUT_MS }).catch(async (e) => {
+      const message2 = String(e.message || "");
+      if (/already been merged/i.test(message2)) {
+        remoteNotAttemptedReason = "pr-already-merged";
+        return;
+      }
+      const note = timeoutKillNote(e, GH_MUTATION_TIMEOUT_MS);
+      if (note) throw new Error(`gh pr merge ${number}: ${note}`);
+      if (!o.auto && !branchUpdated) {
+        const mergeState = prHeadBehindBase({ message: message2 }) ? "BEHIND" : (await execFileP("gh", ["pr", "view", number, ...repoArgs, "--json", "mergeStateStatus", "--jq", ".mergeStateStatus"], { timeout: GC_GH_TIMEOUT_MS4 }).catch(() => ({ stdout: "" }))).stdout.trim();
+        if (prHeadBehindBase({ mergeStateStatus: mergeState })) throw new PrHeadBehindBaseError(message2);
+      }
+      if (isGitHubRateLimitError(e)) {
+        if (o.auto) {
+          throw new Error(`gh pr merge ${number}: GraphQL rate limit exhausted, and enabling auto-merge has no REST equivalent \u2014 retry without --auto to merge now via REST, or retry --auto after the pool resets. (${message2.trim()})`);
         }
-        const note = timeoutKillNote(e, GH_MUTATION_TIMEOUT_MS);
-        if (note) throw new Error(`gh pr merge ${number}: ${note}`);
-        if (isGitHubRateLimitError(e)) {
-          if (o.auto) {
-            throw new Error(`gh pr merge ${number}: GraphQL rate limit exhausted, and enabling auto-merge has no REST equivalent \u2014 retry without --auto to merge now via REST, or retry --auto after the pool resets. (${message2.trim()})`);
+        if (!repoForPostCleanup) throw e;
+        console.warn(`pr merge: gh GraphQL rate-limited \u2014 merging PR #${number} via REST PUT instead (#4588).`);
+        const commitMessage = bodyFile ? (0, import_node_fs43.readFileSync)(bodyFile, "utf8") : void 0;
+        await defaultGitHubClient().rest("PUT", `repos/${repoForPostCleanup}/pulls/${number}/merge`, {
+          body: { merge_method: method.slice(2), ...commitMessage ? { commit_message: commitMessage } : {} },
+          timeoutMs: GH_MUTATION_TIMEOUT_MS
+        });
+        return;
+      }
+      if (!o.auto && mergeRejectedBaseBranchModified(message2)) {
+        console.warn(`pr merge: the base branch was modified by a concurrent merge \u2014 waiting ${PR_MERGE_BASE_RACE_RETRY_DELAY_MS / 1e3}s and retrying PR #${number}'s merge once (#6052).`);
+        await new Promise((resolve7) => setTimeout(resolve7, PR_MERGE_BASE_RACE_RETRY_DELAY_MS));
+        await execFileP("gh", buildPrMergeArgs({ number, repoArgs, method, auto: false, deleteBranch: false, bodyFile }), { timeout: GH_MUTATION_TIMEOUT_MS }).catch((e2) => {
+          const m2 = String(e2.message || "");
+          if (/already been merged/i.test(m2)) {
+            remoteNotAttemptedReason = "pr-already-merged";
+            return;
           }
-          if (!repoForPostCleanup) throw e;
-          console.warn(`pr merge: gh GraphQL rate-limited \u2014 merging PR #${number} via REST PUT instead (#4588).`);
-          const commitMessage = bodyFile ? (0, import_node_fs42.readFileSync)(bodyFile, "utf8") : void 0;
-          await defaultGitHubClient().rest("PUT", `repos/${repoForPostCleanup}/pulls/${number}/merge`, {
-            body: { merge_method: method.slice(2), ...commitMessage ? { commit_message: commitMessage } : {} },
-            timeoutMs: GH_MUTATION_TIMEOUT_MS
-          });
-          return;
-        }
-        if (!o.auto && mergeRejectedBaseBranchModified(message2)) {
-          console.warn(`pr merge: the base branch was modified by a concurrent merge \u2014 waiting ${PR_MERGE_BASE_RACE_RETRY_DELAY_MS / 1e3}s and retrying PR #${number}'s merge once (#6052).`);
-          await new Promise((resolve7) => setTimeout(resolve7, PR_MERGE_BASE_RACE_RETRY_DELAY_MS));
-          await execFileP("gh", buildPrMergeArgs({ number, repoArgs, method, auto: false, deleteBranch: false, bodyFile }), { timeout: GH_MUTATION_TIMEOUT_MS }).catch((e2) => {
-            const m2 = String(e2.message || "");
-            if (/already been merged/i.test(m2)) {
-              remoteNotAttemptedReason = "pr-already-merged";
-              return;
-            }
-            const note2 = timeoutKillNote(e2, GH_MUTATION_TIMEOUT_MS);
-            if (note2) throw new Error(`gh pr merge ${number}: ${note2}`);
-            if (!ghPrMergeLocalBranchDeleteWarning(m2)) throw e2;
-          });
-          return;
-        }
-        if (o.auto && mergeAutoRejectedPrAlreadyClean(message2)) {
-          await execFileP("gh", buildPrMergeArgs({ number, repoArgs, method, auto: false, deleteBranch: false, bodyFile }), { timeout: GH_MUTATION_TIMEOUT_MS }).catch((e2) => {
-            const m2 = String(e2.message || "");
-            if (/already been merged/i.test(m2)) {
-              remoteNotAttemptedReason = "pr-already-merged";
-              return;
-            }
-            const note2 = timeoutKillNote(e2, GH_MUTATION_TIMEOUT_MS);
-            if (note2) throw new Error(`gh pr merge ${number}: ${note2}`);
-            if (!ghPrMergeLocalBranchDeleteWarning(m2)) throw e2;
-          });
-          return;
-        }
-        if (!o.auto && basePolicyBlocksImmediateMerge(message2)) {
-          console.warn(`pr merge: the base-branch policy blocks an immediate merge \u2014 upgrading to --auto (merges once required checks pass).`);
-          upgradedToAuto = true;
-          await execFileP("gh", buildPrMergeArgs({ number, repoArgs, method, auto: true, deleteBranch: false, bodyFile }), { timeout: GH_MUTATION_TIMEOUT_MS }).catch((e2) => {
-            const m2 = String(e2.message || "");
-            if (/already been merged/i.test(m2)) {
-              remoteNotAttemptedReason = "pr-already-merged";
-              return;
-            }
-            const note2 = timeoutKillNote(e2, GH_MUTATION_TIMEOUT_MS);
-            if (note2) throw new Error(`gh pr merge ${number}: ${note2}`);
-            if (!ghPrMergeLocalBranchDeleteWarning(m2)) throw e2;
-          });
-          return;
-        }
-        if (!ghPrMergeLocalBranchDeleteWarning(message2)) throw e;
-      });
+          const note2 = timeoutKillNote(e2, GH_MUTATION_TIMEOUT_MS);
+          if (note2) throw new Error(`gh pr merge ${number}: ${note2}`);
+          if (!ghPrMergeLocalBranchDeleteWarning(m2)) throw e2;
+        });
+        return;
+      }
+      if (o.auto && mergeAutoRejectedPrAlreadyClean(message2)) {
+        await execFileP("gh", buildPrMergeArgs({ number, repoArgs, method, auto: false, deleteBranch: false, bodyFile }), { timeout: GH_MUTATION_TIMEOUT_MS }).catch((e2) => {
+          const m2 = String(e2.message || "");
+          if (/already been merged/i.test(m2)) {
+            remoteNotAttemptedReason = "pr-already-merged";
+            return;
+          }
+          const note2 = timeoutKillNote(e2, GH_MUTATION_TIMEOUT_MS);
+          if (note2) throw new Error(`gh pr merge ${number}: ${note2}`);
+          if (!ghPrMergeLocalBranchDeleteWarning(m2)) throw e2;
+        });
+        return;
+      }
+      if (!o.auto && basePolicyBlocksImmediateMerge(message2)) {
+        console.warn(`pr merge: the base-branch policy blocks an immediate merge \u2014 upgrading to --auto (merges once required checks pass).`);
+        upgradedToAuto = true;
+        await execFileP("gh", buildPrMergeArgs({ number, repoArgs, method, auto: true, deleteBranch: false, bodyFile }), { timeout: GH_MUTATION_TIMEOUT_MS }).catch((e2) => {
+          const m2 = String(e2.message || "");
+          if (/already been merged/i.test(m2)) {
+            remoteNotAttemptedReason = "pr-already-merged";
+            return;
+          }
+          const note2 = timeoutKillNote(e2, GH_MUTATION_TIMEOUT_MS);
+          if (note2) throw new Error(`gh pr merge ${number}: ${note2}`);
+          if (!ghPrMergeLocalBranchDeleteWarning(m2)) throw e2;
+        });
+        return;
+      }
+      if (!ghPrMergeLocalBranchDeleteWarning(message2)) throw e;
+    });
+    try {
+      try {
+        await mergeOnce();
+      } catch (e) {
+        if (!(e instanceof PrHeadBehindBaseError)) throw e;
+        const localCheckedOut = !foreignCwd && await prHeadCheckedOutHere(headRef, targetRepo2, Boolean(o.repo));
+        console.warn(`pr merge: GitHub refused the merge \u2014 PR #${number}'s head is BEHIND ${baseRef} \u2014 updating ${headRef} from the base (${localCheckedOut ? "local merge commit + push" : "GitHub update-branch"}) and retrying once (#6263).`);
+        branchUpdated = await updatePrHeadForMerge({ prNumber: number, repo: await requireRepo(o.repo), head: headRef, base: baseRef, localCheckedOut }).catch((e2) => {
+          throw new Error(`pr merge: ${e2.message}`);
+        });
+        if (o.wait && !await runWaitGate()) return;
+        await mergeOnce();
+      }
     } finally {
       overrideBody?.cleanup();
     }
@@ -39953,7 +40291,8 @@ ${list}`);
         pr: number,
         branch: headRef,
         state: stateRead.ok ? stateRead.state : "unknown",
-        cleanupStatus: "skipped"
+        cleanupStatus: "skipped",
+        ...branchUpdated ? { branchUpdated } : {}
       }));
       console.error(`pr merge: ${gate.message}. Nothing was deleted \u2014 re-check the PR and retry.`);
       process.exitCode = 1;
@@ -39973,7 +40312,7 @@ ${list}`);
           preserveWorktree: o.preserveWorktree,
           gcAcknowledged: o.gc,
           expectedHeadOid: headRefOid,
-          pathExists: (p) => (0, import_node_fs42.existsSync)(p),
+          pathExists: (p) => (0, import_node_fs43.existsSync)(p),
           // #5899: pin cleanup git calls to the main checkout — the task worktree this process may be
           // standing in is removed mid-cleanup, so a cwd-relative invocation fails with
           // 'fatal: not a git repository' and leaves a spurious partial-cleanup exit.
@@ -40064,6 +40403,7 @@ ${list}`);
       ...methodField ? { method: methodField } : {},
       remoteBranch,
       housekeeping,
+      ...branchUpdated ? { branchUpdated } : {},
       ...foreignCwd ? { foreignCwd: true, ...foreignCheckout ? { foreignCheckout } : {} } : {},
       ...partialCleanup.length ? { cleanupStatus: "partial", partialCleanup } : {},
       ...localCleanup?.worktree ? { worktree: localCleanup.worktree } : {},
@@ -40094,7 +40434,7 @@ ${list}`);
 }
 
 // src/command-register-developer.ts
-var import_node_fs47 = require("node:fs");
+var import_node_fs48 = require("node:fs");
 
 // src/whoami.ts
 async function resolveWhoami(deps) {
@@ -40124,7 +40464,7 @@ async function resolveWhoami(deps) {
 }
 
 // src/command-register-developer.ts
-var import_node_path44 = require("node:path");
+var import_node_path45 = require("node:path");
 
 // src/wave-land.ts
 function planWaveLand(prs) {
@@ -40155,7 +40495,7 @@ async function executeWaveLand(plan, deps) {
 }
 
 // src/box-commands.ts
-var import_node_fs43 = require("node:fs");
+var import_node_fs44 = require("node:fs");
 
 // src/box.ts
 var BOX_KEYS = {
@@ -40357,7 +40697,7 @@ function registerBoxCommands(program3) {
         return;
       }
       const wroteScript = o.ssh && o.script ? o.script : null;
-      if (wroteScript) (0, import_node_fs43.writeFileSync)(wroteScript, sshRecipeScript(found), "utf8");
+      if (wroteScript) (0, import_node_fs44.writeFileSync)(wroteScript, sshRecipeScript(found), "utf8");
       if (o.json) {
         console.log(JSON.stringify({
           box: found,
@@ -40377,21 +40717,21 @@ ${SSH_RECIPE_AGENT_NOTE}`);
 }
 
 // src/dist-drift.ts
-var import_node_child_process16 = require("node:child_process");
+var import_node_child_process17 = require("node:child_process");
 var import_node_crypto12 = require("node:crypto");
-var import_node_fs45 = require("node:fs");
-var import_node_os20 = require("node:os");
-var import_node_path41 = require("node:path");
+var import_node_fs46 = require("node:fs");
+var import_node_os21 = require("node:os");
+var import_node_path42 = require("node:path");
 
 // ../scripts/distribution-digest.mjs
 var import_node_crypto11 = require("node:crypto");
-var import_node_fs44 = require("node:fs");
-var import_node_path40 = require("node:path");
+var import_node_fs45 = require("node:fs");
+var import_node_path41 = require("node:path");
 var slash = (value) => value.replaceAll("\\", "/");
 function repoPath(root, declaredPath, label) {
-  const absoluteRoot = (0, import_node_path40.resolve)(root);
-  const target = (0, import_node_path40.resolve)(root, declaredPath);
-  if (target !== absoluteRoot && !target.startsWith(`${absoluteRoot}${import_node_path40.sep}`)) {
+  const absoluteRoot = (0, import_node_path41.resolve)(root);
+  const target = (0, import_node_path41.resolve)(root, declaredPath);
+  if (target !== absoluteRoot && !target.startsWith(`${absoluteRoot}${import_node_path41.sep}`)) {
     throw new Error(`${label} ${declaredPath} escapes the repository root`);
   }
   return target;
@@ -40399,7 +40739,7 @@ function repoPath(root, declaredPath, label) {
 function digestFiles(files) {
   const hash = (0, import_node_crypto11.createHash)("sha256");
   for (const file of [...files].sort((a, b) => a.relative.localeCompare(b.relative))) {
-    const content = file.stat.isSymbolicLink() ? Buffer.from((0, import_node_fs44.readlinkSync)(file.absolute), "utf8") : (0, import_node_fs44.readFileSync)(file.absolute);
+    const content = file.stat.isSymbolicLink() ? Buffer.from((0, import_node_fs45.readlinkSync)(file.absolute), "utf8") : (0, import_node_fs45.readFileSync)(file.absolute);
     hash.update(file.relative, "utf8");
     hash.update("\0");
     hash.update(file.stat.isSymbolicLink() ? "symlink" : "file", "utf8");
@@ -40414,8 +40754,8 @@ function digestFiles(files) {
 function digestPackedFiles(packageRoot, packedFiles) {
   return digestFiles(packedFiles.map((path2) => {
     const absolute = repoPath(packageRoot, path2, "packed artifact identity path");
-    if (!(0, import_node_fs44.existsSync)(absolute)) throw new Error(`packed artifact identity path ${path2} does not exist`);
-    return { absolute, relative: slash(path2), stat: (0, import_node_fs44.lstatSync)(absolute) };
+    if (!(0, import_node_fs45.existsSync)(absolute)) throw new Error(`packed artifact identity path ${path2} does not exist`);
+    return { absolute, relative: slash(path2), stat: (0, import_node_fs45.lstatSync)(absolute) };
   }));
 }
 
@@ -40499,13 +40839,13 @@ function renderDistDriftReceipt(receipt) {
   return lines2;
 }
 function readOrNull(path2) {
-  return (0, import_node_fs45.existsSync)(path2) ? (0, import_node_fs45.readFileSync)(path2) : null;
+  return (0, import_node_fs46.existsSync)(path2) ? (0, import_node_fs46.readFileSync)(path2) : null;
 }
 function walkFiles(root) {
   const files = [];
   const walk2 = (directory) => {
-    for (const entry of (0, import_node_fs45.readdirSync)(directory, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name))) {
-      const child2 = (0, import_node_path41.join)(directory, entry.name);
+    for (const entry of (0, import_node_fs46.readdirSync)(directory, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name))) {
+      const child2 = (0, import_node_path42.join)(directory, entry.name);
       if (entry.isDirectory()) walk2(child2);
       else files.push(child2);
     }
@@ -40515,14 +40855,14 @@ function walkFiles(root) {
 }
 function bomPathFor(root) {
   try {
-    const registry2 = JSON.parse((0, import_node_fs45.readFileSync)((0, import_node_path41.join)(root, "surfaces.json"), "utf8"));
-    return (0, import_node_path41.join)(root, registry2?.sharedAgentCore?.releaseMetadata?.bomPath ?? "distribution-bom.json");
+    const registry2 = JSON.parse((0, import_node_fs46.readFileSync)((0, import_node_path42.join)(root, "surfaces.json"), "utf8"));
+    return (0, import_node_path42.join)(root, registry2?.sharedAgentCore?.releaseMetadata?.bomPath ?? "distribution-bom.json");
   } catch {
-    return (0, import_node_path41.join)(root, "distribution-bom.json");
+    return (0, import_node_path42.join)(root, "distribution-bom.json");
   }
 }
 function rebuildTo(packageRoot, outDir) {
-  (0, import_node_child_process16.execFileSync)(process.execPath, ["build.mjs"], {
+  (0, import_node_child_process17.execFileSync)(process.execPath, ["build.mjs"], {
     cwd: packageRoot,
     env: { ...process.env, MMI_DIST_OUTDIR: outDir },
     windowsHide: true,
@@ -40531,35 +40871,35 @@ function rebuildTo(packageRoot, outDir) {
   });
 }
 function runDistStatus(root) {
-  const stage = (0, import_node_fs45.mkdtempSync)((0, import_node_path41.join)((0, import_node_os20.tmpdir)(), "mmi-dist-drift-"));
+  const stage = (0, import_node_fs46.mkdtempSync)((0, import_node_path42.join)((0, import_node_os21.tmpdir)(), "mmi-dist-drift-"));
   let overlayCount = 0;
   try {
-    const cliOut = (0, import_node_path41.join)(stage, "cli-dist");
-    const hubOut = (0, import_node_path41.join)(stage, "hub-dist");
-    rebuildTo((0, import_node_path41.join)(root, "cli"), cliOut);
-    rebuildTo((0, import_node_path41.join)(root, "updater"), hubOut);
+    const cliOut = (0, import_node_path42.join)(stage, "cli-dist");
+    const hubOut = (0, import_node_path42.join)(stage, "hub-dist");
+    rebuildTo((0, import_node_path42.join)(root, "cli"), cliOut);
+    rebuildTo((0, import_node_path42.join)(root, "updater"), hubOut);
     const outDirFor = (packageDir) => packageDir === "cli" ? cliOut : hubOut;
     const rebuilt = (path2) => {
       const spec = DIST_ARTIFACTS.find((entry) => entry.path === path2);
-      return spec ? readOrNull((0, import_node_path41.join)(outDirFor(spec.packageDir), spec.output)) : null;
+      return spec ? readOrNull((0, import_node_path42.join)(outDirFor(spec.packageDir), spec.output)) : null;
     };
-    const committed = (path2) => readOrNull((0, import_node_path41.join)(root, path2));
-    const tree = (path2) => readOrNull((0, import_node_path41.join)(root, path2));
-    const distRoot = (0, import_node_path41.join)(root, "cli", "dist");
-    const distTree = () => walkFiles(distRoot).map((absolute) => `cli/dist/${(0, import_node_path41.relative)(distRoot, absolute).replaceAll("\\", "/")}`);
-    const bom = JSON.parse((0, import_node_fs45.readFileSync)(bomPathFor(root), "utf8"));
+    const committed = (path2) => readOrNull((0, import_node_path42.join)(root, path2));
+    const tree = (path2) => readOrNull((0, import_node_path42.join)(root, path2));
+    const distRoot = (0, import_node_path42.join)(root, "cli", "dist");
+    const distTree = () => walkFiles(distRoot).map((absolute) => `cli/dist/${(0, import_node_path42.relative)(distRoot, absolute).replaceAll("\\", "/")}`);
+    const bom = JSON.parse((0, import_node_fs46.readFileSync)(bomPathFor(root), "utf8"));
     const digest = (entries) => {
-      const overlay = (0, import_node_path41.join)(stage, `overlay-${overlayCount++}`);
+      const overlay = (0, import_node_path42.join)(stage, `overlay-${overlayCount++}`);
       for (const entry of entries) {
-        const target = (0, import_node_path41.join)(overlay, entry.path);
-        (0, import_node_fs45.mkdirSync)((0, import_node_path41.dirname)(target), { recursive: true });
-        (0, import_node_fs45.writeFileSync)(target, entry.bytes);
+        const target = (0, import_node_path42.join)(overlay, entry.path);
+        (0, import_node_fs46.mkdirSync)((0, import_node_path42.dirname)(target), { recursive: true });
+        (0, import_node_fs46.writeFileSync)(target, entry.bytes);
       }
       return digestPackedFiles(overlay, entries.map((entry) => entry.path));
     };
     return computeDistDriftReceipt({ committed, tree, rebuilt, distTree, bom, digest });
   } finally {
-    (0, import_node_fs45.rmSync)(stage, { recursive: true, force: true });
+    (0, import_node_fs46.rmSync)(stage, { recursive: true, force: true });
   }
 }
 
@@ -40631,7 +40971,7 @@ function registerEdgeCommands(program3) {
 
 // src/schedules-lift-command.ts
 var import_promises8 = require("node:fs/promises");
-var import_node_path42 = require("node:path");
+var import_node_path43 = require("node:path");
 var DEFAULT_WORKFLOWS_DIR = ".github/workflows";
 var SCHEDULE_REPO_RE = /^[A-Za-z0-9_.-]+$/;
 var SchedulesLiftUsageError = class extends Error {
@@ -40658,7 +40998,7 @@ async function readWorkflowFiles(dir) {
   const files = [];
   for (const name of names.sort()) {
     if (!/\.ya?ml$/.test(name)) continue;
-    files.push({ path: `.github/workflows/${name}`, text: await (0, import_promises8.readFile)((0, import_node_path42.join)(dir, name), "utf8") });
+    files.push({ path: `.github/workflows/${name}`, text: await (0, import_promises8.readFile)((0, import_node_path43.join)(dir, name), "utf8") });
   }
   return files;
 }
@@ -40740,9 +41080,9 @@ function registerSchedulesLiftCommand(program3, deps = {}) {
 }
 
 // src/spawn-policy-core.ts
-var import_node_child_process17 = require("node:child_process");
-var import_node_fs46 = require("node:fs");
-var import_node_path43 = require("node:path");
+var import_node_child_process18 = require("node:child_process");
+var import_node_fs47 = require("node:fs");
+var import_node_path44 = require("node:path");
 var SPAWNERS = ["spawn", "spawnSync", "exec", "execSync", "execFile", "execFileSync"];
 var CALL_SOURCE = String.raw`(^|[^.\w$])(${SPAWNERS.join("|")})\s*\(`;
 var SOURCE_EXT = /\.(ts|mts|cts|js|mjs|cjs)$/;
@@ -40811,7 +41151,7 @@ function findViolationsInSource(raw) {
   return found;
 }
 function policedFiles(root) {
-  const r = (0, import_node_child_process17.spawnSync)("git", ["ls-files", "-z", "--cached", "--others", "--exclude-standard"], {
+  const r = (0, import_node_child_process18.spawnSync)("git", ["ls-files", "-z", "--cached", "--others", "--exclude-standard"], {
     cwd: root,
     encoding: "utf8",
     windowsHide: true,
@@ -40828,7 +41168,7 @@ function runSpawnPolicy(root) {
   for (const file of files) {
     let raw;
     try {
-      raw = (0, import_node_fs46.readFileSync)((0, import_node_path43.join)(root, file), "utf8");
+      raw = (0, import_node_fs47.readFileSync)((0, import_node_path44.join)(root, file), "utf8");
     } catch {
       continue;
     }
@@ -40848,19 +41188,19 @@ function runSpawnPolicy(root) {
 function registerDeveloperCommands(program3) {
   const rules = program3.command("rules").description("org-managed .gitignore delivery");
   rules.command("gitignore").option("--write", "upsert the managed block into .gitignore (default: check only, non-zero exit on drift)").option("--json", "machine-readable output").description("verify (or --write) this repo's org-managed .gitignore block matches the SSOT").action((opts) => {
-    const path2 = (0, import_node_path44.join)(process.cwd(), ".gitignore");
-    const current = (0, import_node_fs47.existsSync)(path2) ? (0, import_node_fs47.readFileSync)(path2, "utf8") : null;
+    const path2 = (0, import_node_path45.join)(process.cwd(), ".gitignore");
+    const current = (0, import_node_fs48.existsSync)(path2) ? (0, import_node_fs48.readFileSync)(path2, "utf8") : null;
     const plan = planManagedGitignore(current);
     const drift = [...plan.added.map((l) => `+${l}`), ...plan.removed.map((l) => `-${l}`)].join(", ") || "block normalize";
     if (opts.json) {
-      if (opts.write && plan.changed) (0, import_node_fs47.writeFileSync)(path2, plan.content, "utf8");
+      if (opts.write && plan.changed) (0, import_node_fs48.writeFileSync)(path2, plan.content, "utf8");
       console.log(JSON.stringify(plan, null, 2));
       if (!opts.write && plan.changed) process.exitCode = 1;
       return;
     }
     if (opts.write) {
       if (plan.changed) {
-        (0, import_node_fs47.writeFileSync)(path2, plan.content, "utf8");
+        (0, import_node_fs48.writeFileSync)(path2, plan.content, "utf8");
         console.log(`mmi-cli devops org rules gitignore: updated .gitignore (${drift})`);
       } else {
         console.log("mmi-cli devops org rules gitignore: up to date");
@@ -42348,12 +42688,12 @@ async function findInFlightHotfixVersion(deps, ctx, latestMainTag, workflows = H
 }
 
 // src/hotfix-coverage.ts
-var import_node_child_process18 = require("node:child_process");
+var import_node_child_process19 = require("node:child_process");
 var CHERRY_TRAILER = /\(cherry picked from commit ([0-9a-f]{7,40})\)/g;
 function checkHotfixCoverage(options = {}) {
   const { cwd = process.cwd(), mainRef = "origin/main", rcRef = "origin/rc", manifestPaths = [] } = options;
   const ack = (options.ack ?? []).filter(Boolean);
-  const git3 = options.git ?? ((args, opts) => (0, import_node_child_process18.execFileSync)("git", args, { cwd, encoding: "utf8", input: opts?.input, stdio: ["pipe", "pipe", "pipe"] }));
+  const git3 = options.git ?? ((args, opts) => (0, import_node_child_process19.execFileSync)("git", args, { cwd, encoding: "utf8", input: opts?.input, stdio: ["pipe", "pipe", "pipe"] }));
   const revList = (range) => {
     const out = git3(["rev-list", "--no-merges", range]).trim();
     return out ? out.split("\n") : [];
@@ -42421,7 +42761,7 @@ function checkHotfixCoverage(options = {}) {
 }
 function checkHotfixCarries(options) {
   const { cwd = process.cwd(), branch, baseRef, targets } = options;
-  const git3 = options.git ?? ((args, opts) => (0, import_node_child_process18.execFileSync)("git", args, { cwd, encoding: "utf8", input: opts?.input, stdio: ["pipe", "pipe", "pipe"] }));
+  const git3 = options.git ?? ((args, opts) => (0, import_node_child_process19.execFileSync)("git", args, { cwd, encoding: "utf8", input: opts?.input, stdio: ["pipe", "pipe", "pipe"] }));
   const isAncestor = (sha, ref) => {
     try {
       git3(["merge-base", "--is-ancestor", sha, ref]);
@@ -42453,8 +42793,8 @@ function checkHotfixCarries(options) {
 }
 
 // src/train-commands.ts
-var import_node_fs48 = require("node:fs");
-var import_node_path45 = require("node:path");
+var import_node_fs49 = require("node:fs");
+var import_node_path46 = require("node:path");
 var INVOKED_ARGV = process.argv.slice(2);
 var RELEASE_BUMP_INTENTS = ["major", "minor", "patch"];
 function resolveReleaseBumpIntent(raw) {
@@ -42466,7 +42806,7 @@ function resolveReleaseBumpIntent(raw) {
 }
 function readRepoVersion() {
   try {
-    return JSON.parse((0, import_node_fs48.readFileSync)((0, import_node_path45.join)(process.cwd(), ".claude-plugin", "plugin.json"), "utf8")).version || void 0;
+    return JSON.parse((0, import_node_fs49.readFileSync)((0, import_node_path46.join)(process.cwd(), ".claude-plugin", "plugin.json"), "utf8")).version || void 0;
   } catch {
     return void 0;
   }
@@ -43210,12 +43550,12 @@ ${r.stderr ?? ""}`).catch(() => "");
 var ENV_HEAL_LOCK_STALE_MS = 10 * 6e4;
 var ENV_HEAL_LOCK_MAX_WAIT_MS = 2 * 6e4;
 function envHealLockPath(home) {
-  return (0, import_node_path46.join)(home, ".claude", "plugins", ".mmi-env-heal.lock");
+  return (0, import_node_path47.join)(home, ".claude", "plugins", ".mmi-env-heal.lock");
 }
 async function withEnvHealLock(what, run) {
   try {
     return await withFileLock(
-      envHealLockPath((0, import_node_os21.homedir)()),
+      envHealLockPath((0, import_node_os22.homedir)()),
       { staleMs: ENV_HEAL_LOCK_STALE_MS, maxWaitMs: ENV_HEAL_LOCK_MAX_WAIT_MS, label: "mmi env-heal lock" },
       run
     );
@@ -43311,7 +43651,7 @@ function mmiDoctorDeps(opts = {}) {
       const configRoot = surfaceConfigRoot(surface);
       const running = surface === "codex" ? installedActivePluginVersion(surface) : runningPluginVersion(process.env, resolveClientVersion());
       const plan = buildPluginCachePlan(
-        (0, import_node_os21.homedir)(),
+        (0, import_node_os22.homedir)(),
         running,
         pluginCacheFsDeps(configRoot, () => 0),
         { configRoot, includeStaging: surface !== "codex" }
@@ -43339,14 +43679,14 @@ function mmiDoctorDeps(opts = {}) {
       const running = surface === "codex" ? installedActivePluginVersion(surface) : runningPluginVersion(process.env, resolveClientVersion());
       const installed = installedActivePluginVersion(surface);
       const plan = buildPluginCachePlan(
-        (0, import_node_os21.homedir)(),
+        (0, import_node_os22.homedir)(),
         running,
         pluginCacheFsDeps(configRoot, () => 0),
         { configRoot, includeStaging: surface !== "codex", installedVersion: installed }
       );
       const result = applyPluginCachePlan(
         plan,
-        (p) => (0, import_node_fs49.rmSync)(p, { recursive: true }),
+        (p) => (0, import_node_fs50.rmSync)(p, { recursive: true }),
         stagingApplyFsGuard(configRoot)
       );
       return {
@@ -43381,7 +43721,7 @@ function mmiDoctorDeps(opts = {}) {
     // has no generated routing index would
     // get a permanent — demanding an artifact it never asked for.
     docsIndexState: (root) => {
-      if (!(0, import_node_fs49.existsSync)((0, import_node_path46.join)(root, DOCS_INDEX_PATH))) return void 0;
+      if (!(0, import_node_fs50.existsSync)((0, import_node_path47.join)(root, DOCS_INDEX_PATH))) return void 0;
       const real = createDocsIndexDeps(root);
       let docs;
       const listDocs = () => docs ??= real.listDocs();
@@ -43390,7 +43730,7 @@ function mmiDoctorDeps(opts = {}) {
     },
     // #4168: working-tree heal — write if drifted, then re-check. Commit remains the operator's step.
     healDocsIndex: (root) => {
-      if (!(0, import_node_fs49.existsSync)((0, import_node_path46.join)(root, DOCS_INDEX_PATH))) return { drift: false, docCount: 0 };
+      if (!(0, import_node_fs50.existsSync)((0, import_node_path47.join)(root, DOCS_INDEX_PATH))) return { drift: false, docCount: 0 };
       const real = createDocsIndexDeps(root);
       let docs;
       const listDocs = () => docs ??= real.listDocs();
@@ -43949,7 +44289,7 @@ project.command("set [owner/repo]").description("upsert project META (idempotent
   if (dupe) return fail(`org project set: KEY "${dupe}" was passed to both --var and --set; --set is an alias of --var, so pass each KEY once`);
   if (o.secretsFile) {
     try {
-      vars.push(`secrets=${(0, import_node_fs49.readFileSync)(o.secretsFile, "utf8")}`);
+      vars.push(`secrets=${(0, import_node_fs50.readFileSync)(o.secretsFile, "utf8")}`);
     } catch (e) {
       return fail(`org project set: cannot read --secrets-file ${o.secretsFile}: ${e.message}`);
     }
@@ -44262,16 +44602,16 @@ function ciAuditDeps2() {
     // gate re-seed step is skipped gracefully rather than failing mid-run.
     readSeedFile: (path2) => {
       if (!root) return null;
-      const fullPath = (0, import_node_path46.join)(root, path2);
-      return (0, import_node_fs49.existsSync)(fullPath) ? (0, import_node_fs49.readFileSync)(fullPath, "utf8") : null;
+      const fullPath = (0, import_node_path47.join)(root, path2);
+      return (0, import_node_fs50.existsSync)(fullPath) ? (0, import_node_fs50.readFileSync)(fullPath, "utf8") : null;
     }
   };
 }
 function hubRoot2() {
-  const fromPkg = (0, import_node_path46.join)(__dirname, "..", "..");
+  const fromPkg = (0, import_node_path47.join)(__dirname, "..", "..");
   const marker = "skills/bootstrap/seeds/manifest.json";
-  if ((0, import_node_fs49.existsSync)((0, import_node_path46.join)(fromPkg, marker))) return fromPkg;
-  if ((0, import_node_fs49.existsSync)((0, import_node_path46.join)(process.cwd(), marker))) return process.cwd();
+  if ((0, import_node_fs50.existsSync)((0, import_node_path47.join)(fromPkg, marker))) return fromPkg;
+  if ((0, import_node_fs50.existsSync)((0, import_node_path47.join)(process.cwd(), marker))) return process.cwd();
   return null;
 }
 registerQueryCommands(program2);
@@ -44371,10 +44711,10 @@ access.command("audit").description("audit collaborator roles + train-branch pus
     targets = resolution.targets;
   }
   const derivedMatrix = registryProjects ? accessMatrixFromProjects(registryProjects) : {};
-  const fileMatrix = (0, import_node_fs49.existsSync)("access-matrix.json") ? loadAccessMatrix((0, import_node_fs49.readFileSync)("access-matrix.json", "utf8")) : {};
+  const fileMatrix = (0, import_node_fs50.existsSync)("access-matrix.json") ? loadAccessMatrix((0, import_node_fs50.readFileSync)("access-matrix.json", "utf8")) : {};
   const matrix = mergeAccessMatrix(fileMatrix, derivedMatrix);
   const dataAccess = registryProjects ? dataAccessContractsFromProjects(registryProjects) : { consumers: {} };
-  const sanctioned = (0, import_node_fs49.existsSync)("access-matrix.json") ? loadSanctionedAdmins((0, import_node_fs49.readFileSync)("access-matrix.json", "utf8")) : {};
+  const sanctioned = (0, import_node_fs50.existsSync)("access-matrix.json") ? loadSanctionedAdmins((0, import_node_fs50.readFileSync)("access-matrix.json", "utf8")) : {};
   const report = await auditOrgAccess(targets, deps, matrix, dataAccess, sanctioned);
   console.log(o.json ? JSON.stringify(report, null, 2) : renderAccessReport(report));
   if (!report.ok) process.exitCode = 1;
@@ -44405,16 +44745,16 @@ function directoryBytes(path2) {
   let total = 0;
   let entries;
   try {
-    entries = (0, import_node_fs49.readdirSync)(path2, { withFileTypes: true });
+    entries = (0, import_node_fs50.readdirSync)(path2, { withFileTypes: true });
   } catch {
     return 0;
   }
   for (const entry of entries) {
-    const child2 = (0, import_node_path46.join)(path2, entry.name);
+    const child2 = (0, import_node_path47.join)(path2, entry.name);
     if (entry.isDirectory()) total += directoryBytes(child2);
     else {
       try {
-        total += (0, import_node_fs49.statSync)(child2).size;
+        total += (0, import_node_fs50.statSync)(child2).size;
       } catch {
       }
     }
@@ -44422,25 +44762,25 @@ function directoryBytes(path2) {
   return total;
 }
 function listDirEntries(dir) {
-  return (0, import_node_fs49.readdirSync)(dir, { withFileTypes: true }).map((d) => ({ name: d.name, isDirectory: d.isDirectory() }));
+  return (0, import_node_fs50.readdirSync)(dir, { withFileTypes: true }).map((d) => ({ name: d.name, isDirectory: d.isDirectory() }));
 }
 function readInstalledPluginRefs(configRoot) {
   const p = installedPluginsPathForConfig(configRoot);
-  if (!(0, import_node_fs49.existsSync)(p)) return [];
+  if (!(0, import_node_fs50.existsSync)(p)) return [];
   try {
-    return installedPluginPaths((0, import_node_fs49.readFileSync)(p, "utf8"));
+    return installedPluginPaths((0, import_node_fs50.readFileSync)(p, "utf8"));
   } catch {
     return null;
   }
 }
 function pluginCacheFsDeps(configRoot, dirBytes) {
   return {
-    exists: (p) => (0, import_node_fs49.existsSync)(p),
-    listVersionDirs: (root) => (0, import_node_fs49.readdirSync)(root, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name),
+    exists: (p) => (0, import_node_fs50.existsSync)(p),
+    listVersionDirs: (root) => (0, import_node_fs50.readdirSync)(root, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name),
     dirBytes,
-    listStagingDirs: (root) => (0, import_node_fs49.readdirSync)(root, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => {
+    listStagingDirs: (root) => (0, import_node_fs50.readdirSync)(root, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => {
       try {
-        return { name: d.name, mtimeMs: newestMtimeMs((0, import_node_path46.join)(root, d.name), listDirEntries, (p) => (0, import_node_fs49.statSync)(p).mtimeMs) };
+        return { name: d.name, mtimeMs: newestMtimeMs((0, import_node_path47.join)(root, d.name), listDirEntries, (p) => (0, import_node_fs50.statSync)(p).mtimeMs) };
       } catch {
         return { name: d.name, mtimeMs: Date.now() };
       }
@@ -44454,10 +44794,10 @@ function stagingApplyFsGuard(configRoot) {
   return {
     referencedPaths: () => readInstalledPluginRefs(configRoot),
     mtimeMs: (name) => {
-      const p = (0, import_node_path46.join)(stagingRoot, name);
-      if (!(0, import_node_fs49.existsSync)(p)) return null;
+      const p = (0, import_node_path47.join)(stagingRoot, name);
+      if (!(0, import_node_fs50.existsSync)(p)) return null;
       try {
-        return newestMtimeMs(p, listDirEntries, (q) => (0, import_node_fs49.statSync)(q).mtimeMs);
+        return newestMtimeMs(p, listDirEntries, (q) => (0, import_node_fs50.statSync)(q).mtimeMs);
       } catch {
         return null;
       }
@@ -44477,13 +44817,13 @@ program2.command("plugin-prune").description(`prune stale cached MMI plugin vers
     return;
   }
   const plan = buildPluginCachePlan(
-    (0, import_node_os21.homedir)(),
+    (0, import_node_os22.homedir)(),
     running,
     pluginCacheFsDeps(configRoot, directoryBytes),
     { withBytes: true, configRoot, includeStaging: surface !== "codex" }
   );
   const anythingToDelete = plan.prune.length > 0 || plan.staging.length > 0;
-  const result = o.apply && anythingToDelete ? applyPluginCachePlan(plan, (p) => (0, import_node_fs49.rmSync)(p, { recursive: true, force: true }), stagingApplyFsGuard(configRoot)) : void 0;
+  const result = o.apply && anythingToDelete ? applyPluginCachePlan(plan, (p) => (0, import_node_fs50.rmSync)(p, { recursive: true, force: true }), stagingApplyFsGuard(configRoot)) : void 0;
   const warnings = plan.prune.length > 0 ? [CONCURRENT_SESSION_WARNING] : [];
   if (o.json) console.log(JSON.stringify({ ...plan, warnings, applied: result ?? null }));
   else console.log(renderPluginCachePlan(plan, result));