@mutmutco/cli 4.3.6 → 4.3.8

package/dist/main.cjs

@@ -6998,6 +6998,19 @@ function isPromotionBase(base, track) {
 }
 
 // src/readiness-audit.ts
+async function probeHttpBounded(url, timeoutMs = 5e3) {
+  try {
+    const res = await fetch(url, { method: "GET", signal: AbortSignal.timeout(timeoutMs) });
+    return { ok: res.ok, status: res.status, url };
+  } catch (e) {
+    return { ok: false, error: e.message, url };
+  }
+}
+async function probePublicHealth(publicUrl) {
+  const root = await probeHttpBounded(publicUrl);
+  if (root.status !== 401 && root.status !== 403) return root;
+  return probeHttpBounded(`${publicUrl.replace(/\/$/, "")}/health`);
+}
 var TENANT_DEPLOY_RUN_SCAN_LIMIT = 100;
 function pickTenantDeployRun(rows, slug, stage) {
   const escaped = slug.replace(/[.*+?^${}()|[\]\\-]/g, "\\$&");
@@ -7016,7 +7029,8 @@ function tenantRuntimeHints(stage, fact, probe) {
   if (!fact.sshHostPresent && fact.substrate === "hetzner-ssh") hints.push(`DEPLOY#${stage} has hetzner-ssh substrate but no sshHost presence; tenant-deploy cannot reach the box.`);
   if (!fact.domain) hints.push(`DEPLOY#${stage} has no edgeVhost.domain; Cloudflare/Caddy public URL cannot be derived.`);
   if (typeof fact.port !== "number") hints.push(`DEPLOY#${stage} has no edgeVhost.port; Caddy upstream/healthUrl hints cannot be checked.`);
-  if (probe?.ok === false || probe?.status != null && probe.status >= 500) hints.push("Public URL probe failed; for Cloudflare 525 check Caddy TLS/origin certificate and Cloudflare SSL mode before changing app code.");
+  if (probe?.url?.endsWith("/health") && probe.ok === false) hints.push(`Root is auth-walled (401/403) and ${probe.url} answered ${probe.status ?? probe.error}; expose a 2xx /health route or fix the app \u2014 the edge is fine.`);
+  else if (probe?.ok === false || probe?.status != null && probe.status >= 500) hints.push("Public URL probe failed; for Cloudflare 525 check Caddy TLS/origin certificate and Cloudflare SSL mode before changing app code.");
   if (stage === "rc") hints.push("rc runtime is expected to be ephemeral: present between /rcand and /release, then retired after release.");
   return hints;
 }
@@ -9347,8 +9361,6 @@ function normalizeTitle(title) {
   return title.toLowerCase().replace(/[^a-z0-9]+/g, " ").trim();
 }
 var REPORT_TIMEOUT_MS = 8e3;
-var RED_TEAM_SLA_DAYS = 14;
-var RED_TEAM_SLA_MS = RED_TEAM_SLA_DAYS * 24 * 60 * 60 * 1e3;
 async function fileReport(deps, req) {
   const res = await deps.fetch(`${deps.apiUrl}/reports`, {
     method: "POST",
@@ -9437,7 +9449,7 @@ function invalidReference(ref) {
   return new Error(`invalid reference "${ref}" \u2014 expected ${ISSUE_REF_SHAPES}`);
 }
 function parseIssueRef(ref, expectedRepo) {
-  const trimmed = ref.trim();
+  const trimmed = String(ref).trim();
   const url = trimmed.match(/^https:\/\/github\.com\/([^/]+\/[^/]+)\/(?:issues|pull)\/(\d+)$/i);
   const qualified = trimmed.match(/^([^/\s#]+\/[^/\s#]+)#(\d+)$/);
   const bare = trimmed.match(/^#?(\d+)$/);
@@ -11063,14 +11075,7 @@ function writableOrUnknown(writable) {
 function renderBoardSource() {
   return "source: live";
 }
-async function readBoard(options, deps = {}) {
-  const cfg = resolveBoardConfig(options.config);
-  const client = deps.client ?? defaultGitHubClient();
-  let collected;
-  let writable;
-  let pullRequests;
-  let github;
-  let snapshotFallback;
+async function collectBoardPreferringSnapshot(cfg, options, deps) {
   const attempt = deps.snapshot ? await fetchHubBoardSnapshot(
     {
       owner: cfg.projectOwner,
@@ -11096,19 +11101,37 @@ async function readBoard(options, deps = {}) {
       warnings.push(message2);
       partial = true;
     }
+    return {
+      collected: {
+        items: read.items,
+        viewer: snapshot.viewer,
+        repo: currentRepo,
+        projectId: snapshot.project.id,
+        projectTitle: snapshot.project.title,
+        warnings,
+        partial
+      },
+      snapshot
+    };
+  }
+  const collected = await collectBoardItems(cfg, { repo: options.repo, allowPartial: options.allowPartial, activeOnly: true }, deps);
+  if (attempt?.state === "unavailable") {
+    collected.warnings.push(`Hub board snapshot unavailable (${attempt.reason}) \u2014 served by the direct user-auth read (emergency fallback)`);
+  }
+  return { collected };
+}
+async function readBoard(options, deps = {}) {
+  const cfg = resolveBoardConfig(options.config);
+  const client = deps.client ?? defaultGitHubClient();
+  const { collected, snapshot } = await collectBoardPreferringSnapshot(cfg, options, deps);
+  let writable;
+  let pullRequests;
+  let github;
+  if (snapshot) {
     for (const unreadable of snapshot.unreadableRepos) {
-      warnings.push(`partial claimable access read: ${unreadable.repo}: viewer write access UNREAD (${unreadable.error})`);
-      partial = true;
+      collected.warnings.push(`partial claimable access read: ${unreadable.repo}: viewer write access UNREAD (${unreadable.error})`);
+      collected.partial = true;
     }
-    collected = {
-      items: read.items,
-      viewer: snapshot.viewer,
-      repo: currentRepo,
-      projectId: snapshot.project.id,
-      projectTitle: snapshot.project.title,
-      warnings,
-      partial
-    };
     writable = {
       repos: new Set(snapshot.writableRepos.map((repo) => repo.toLowerCase())),
       unknown: new Set(snapshot.unreadableRepos.map((entry) => entry.repo.toLowerCase()))
@@ -11116,11 +11139,6 @@ async function readBoard(options, deps = {}) {
     pullRequests = snapshot.pullRequests;
     github = snapshot.github;
   } else {
-    if (attempt?.state === "unavailable") snapshotFallback = attempt.reason;
-    collected = await collectBoardItems(cfg, { repo: options.repo, allowPartial: options.allowPartial, activeOnly: true }, deps);
-    if (snapshotFallback) {
-      collected.warnings.push(`Hub board snapshot unavailable (${snapshotFallback}) \u2014 served by the direct user-auth read (emergency fallback)`);
-    }
     const probed = await resolveWritableReposForClaimables(collected.items, client);
     collected.warnings.push(...probed.warnings);
     collected.partial = collected.partial || probed.partial;
@@ -12059,21 +12077,45 @@ async function moveBoardItem(options, deps = {}) {
     partial: false
   };
 }
-async function prepareClaimContext(options, selectors, deps, collected) {
+async function resolveClaimWritable(collected, client, snapshot, unscanned) {
+  const probe = async (items) => {
+    const probed2 = await resolveWritableReposForClaimables(items, client);
+    collected.warnings.push(...probed2.warnings);
+    collected.partial = collected.partial || probed2.partial;
+    return probed2;
+  };
+  if (!snapshot) {
+    const probed2 = await probe(collected.items);
+    return { repos: probed2.repos, unknown: probed2.unknown };
+  }
+  for (const unreadable of snapshot.unreadableRepos) {
+    collected.warnings.push(`partial claimable access read: ${unreadable.repo}: viewer write access UNREAD (${unreadable.error})`);
+    collected.partial = true;
+  }
+  const repos = new Set(snapshot.writableRepos.map((repo) => repo.toLowerCase()));
+  const unknown = new Set(snapshot.unreadableRepos.map((entry) => entry.repo.toLowerCase()));
+  const missed = unscanned.filter((item) => !repos.has(item.repository.toLowerCase()) && !unknown.has(item.repository.toLowerCase()));
+  if (!missed.length) return { repos, unknown };
+  const probed = await probe(missed);
+  return { repos: /* @__PURE__ */ new Set([...repos, ...probed.repos]), unknown: /* @__PURE__ */ new Set([...unknown, ...probed.unknown]) };
+}
+async function prepareClaimContext(options, selectors, deps, collected, snapshot) {
   const cfg = resolveBoardConfig(options.config);
   const client = deps.client ?? defaultGitHubClient();
   const board = { owner: cfg.projectOwner, number: cfg.projectNumber };
+  const unscanned = [];
   for (const selector of selectors) {
     try {
       findBoardItem(collected.items, selector, board);
     } catch {
       const fallback = (await fetchIssueProjectItem(client, cfg, selector)).item;
-      if (fallback) collected.items.push(fallback);
+      if (fallback) {
+        collected.items.push(fallback);
+        unscanned.push(fallback);
+      }
     }
   }
-  const writable = await resolveWritableReposForClaimables(collected.items, client);
-  collected.warnings.push(...writable.warnings);
-  collected.partial = collected.partial || writable.partial;
+  const writable = await resolveClaimWritable(collected, client, snapshot, unscanned);
   const report = {
     project: { owner: cfg.projectOwner, number: cfg.projectNumber, id: collected.projectId, title: collected.projectTitle || String(cfg.projectNumber) },
     viewer: collected.viewer,
@@ -12211,14 +12253,15 @@ async function claimOneBoardItem(ctx, selector, options) {
 }
 async function claimBoardIssue(options, deps = {}) {
   const cfg = resolveBoardConfig(options.config);
-  const collected = await collectBoardItems(cfg, { repo: options.repo, allowPartial: options.allowPartial, activeOnly: true }, deps);
+  const { collected, snapshot } = await collectBoardPreferringSnapshot(cfg, options, deps);
   const selector = parseIssueSelector(options.selector, collected.repo, options.repo);
-  const ctx = await prepareClaimContext(options, [selector], deps, collected);
-  return claimOneBoardItem(ctx, selector, options);
+  const ctx = await prepareClaimContext(options, [selector], deps, collected, snapshot);
+  const result = await claimOneBoardItem(ctx, selector, options);
+  return ctx.report.warnings.length ? { ...result, warnings: [...ctx.report.warnings] } : result;
 }
 async function claimBoardIssues(options, deps = {}) {
   const cfg = resolveBoardConfig(options.config);
-  const collected = await collectBoardItems(cfg, { repo: options.repo, allowPartial: options.allowPartial, activeOnly: true }, deps);
+  const { collected, snapshot } = await collectBoardPreferringSnapshot(cfg, options, deps);
   const selectors = [];
   const seen = /* @__PURE__ */ new Set();
   for (const raw of options.selectors) {
@@ -12228,7 +12271,7 @@ async function claimBoardIssues(options, deps = {}) {
     seen.add(key);
     selectors.push(selector);
   }
-  const ctx = await prepareClaimContext(options, selectors, deps, collected);
+  const ctx = await prepareClaimContext(options, selectors, deps, collected, snapshot);
   const results = new Array(selectors.length);
   let next = 0;
   const worker = async () => {
@@ -12249,7 +12292,9 @@ async function claimBoardIssues(options, deps = {}) {
     viewer: ctx.report.viewer,
     repo: ctx.report.repo,
     results,
-    failed: results.filter((result) => !result.claimed).length
+    failed: results.filter((result) => !result.claimed).length,
+    // #6162: as in claimBoardIssue — the emergency user-auth fallback is named with the verdict.
+    ...ctx.report.warnings.length ? { warnings: [...ctx.report.warnings] } : {}
   };
 }
 async function moveBoardIssues(options, deps = {}) {
@@ -14321,6 +14366,12 @@ function trainFollowUpNote(status) {
   return `follow-up ${status}: the exit code is never the verdict, read workflowRuns \u2014 see docs/Guides/train-troubleshooting.md#follow-up-pending`;
 }
 var TRAIN_DEPLOY_FAILED_NOTE = "promotion stands; retry the deploy, do not re-tag \u2014 see docs/Guides/train-troubleshooting.md#deploy-failed";
+function missingRunUrlNote(runId) {
+  return runId != null ? `no run URL emitted \u2014 GitHub Actions returned run ${runId} without its URL` : "no run URL emitted \u2014 run absent or unreadable";
+}
+function workflowRunWithEvidence(run) {
+  return run.runUrl || run.runUrlNote ? run : { ...run, runUrlNote: missingRunUrlNote(run.runId) };
+}
 function isCentralDispatchModel(model) {
   return model === "tenant-container" || model === "solo-container" || model === "static-cdn";
 }
@@ -15399,10 +15450,10 @@ var rollout_plan_default = {
     note: "The v4.0.0 stamp happens at cut time (D6e #4463); until then the candidate is the origin/development head artifacts (built cli/dist + npm pack), identity proven by dist content hash (D6a)."
   },
   baseline: {
-    version: "4.3.6",
-    tag: "v4.3.6",
-    commit: "b8e51db4f933",
-    npm: "@mutmutco/cli@4.3.6"
+    version: "4.3.8",
+    tag: "v4.3.8",
+    commit: "b109b86b97d1",
+    npm: "@mutmutco/cli@4.3.8"
   },
   exitCriterion: "fleet-n-of-n",
   hubOnlyShortcut: "forbidden",
@@ -15419,14 +15470,14 @@ var rollout_plan_default = {
           repo: "mutmutco/mmi-hub",
           role: "canary",
           schedule: "train",
-          v3Target: "v4.3.6"
+          v3Target: "v4.3.8"
         }
       ],
       rollbackTrigger: "Any red inside the post-contract soak window: `devops train gate` FAIL attributable to the v4 doors, Hub endpoint health probe failure, a pre-v4 client admitted instead of receiving actionable HTTP 426, or npm consumer install/doctor failure on the v4-only dist.",
       rollback: {
         independent: true,
-        mechanism: "npm dist-tag latest -> 4.3.6 and redeploy the Hub Lambda from tag v4.3.6 (b8e51db4f933); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
-        v3Target: "v4.3.6 (@mutmutco/cli@4.3.6, tag commit b8e51db4f933 \u2014 last known-good release carrying the repo-index v4-only contract)"
+        mechanism: "npm dist-tag latest -> 4.3.8 and redeploy the Hub Lambda from tag v4.3.8 (b109b86b97d1); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
+        v3Target: "v4.3.8 (@mutmutco/cli@4.3.8, tag commit b109b86b97d1 \u2014 last known-good release carrying the repo-index v4-only contract)"
       }
     },
     {
@@ -18276,12 +18327,14 @@ function appendPublishDispatch(deploy, publish) {
     deployStatus: deploy.deployStatus === "failure" || publish.deployStatus === "failure" ? "failure" : deploy.deployStatus === "pending" || publish.deployStatus === "pending" ? "pending" : "success"
   };
 }
+var JERV_GATEWAY_RUN_URL_NOTE = "no run URL emitted \u2014 host health leg runs outside GitHub Actions";
 async function appendJervGatewayReleaseDeploy(deps, repo, tag, tagSha, dispatch) {
   if (!isJervHubRepo(repo)) return dispatch;
   if (dispatch.deployStatus !== "success") {
     return {
       ...dispatch,
-      note: `${dispatch.note}; Jerv Gateway deploy deferred until package publication is proven green`
+      note: `${dispatch.note}; Jerv Gateway deploy deferred until package publication is proven green`,
+      workflowRuns: [...dispatch.workflowRuns ?? [], { workflow: "jerv-gateway", runUrlNote: JERV_GATEWAY_RUN_URL_NOTE, conclusion: "pending" }]
     };
   }
   try {
@@ -18299,7 +18352,7 @@ async function appendJervGatewayReleaseDeploy(deps, repo, tag, tagSha, dispatch)
     return {
       ...dispatch,
       note: `${dispatch.note}; Jerv Gateway deployed ${tagSha.slice(0, 12)} and passed health checks`,
-      workflowRuns: [...dispatch.workflowRuns ?? [], { workflow: "jerv-gateway", conclusion: "success" }],
+      workflowRuns: [...dispatch.workflowRuns ?? [], { workflow: "jerv-gateway", runUrlNote: JERV_GATEWAY_RUN_URL_NOTE, conclusion: "success" }],
       deployStatus: "success"
     };
   } catch (error) {
@@ -18308,7 +18361,7 @@ async function appendJervGatewayReleaseDeploy(deps, repo, tag, tagSha, dispatch)
       ...dispatch,
       // #6095: the helper's receipt, health or rollback failed after a proven publish — the release resumes, never re-tags.
       note: `${dispatch.note}; Jerv Gateway deploy FAILED (${detail}) \u2014 see docs/Guides/train-troubleshooting.md#jerv-gateway-deploy`,
-      workflowRuns: [...dispatch.workflowRuns ?? [], { workflow: "jerv-gateway", conclusion: "failure" }],
+      workflowRuns: [...dispatch.workflowRuns ?? [], { workflow: "jerv-gateway", runUrlNote: JERV_GATEWAY_RUN_URL_NOTE, conclusion: "failure" }],
       deployStatus: "failure"
     };
   }
@@ -20594,8 +20647,11 @@ function deployPhaseInput(model, dispatch, opts = {}) {
         note: deployRun ? `${deployRun.workflow} release run` : dispatch.note
       };
     }
-    case "registry-publish":
+    case "registry-publish": {
+      const hostRun = (dispatch.workflowRuns ?? []).find((r) => r.workflow === "jerv-gateway");
+      if (hostRun) return { state: runRowState(hostRun, dispatch.deployStatus), ...sha ? { sha } : {}, workflow: hostRun.workflow, note: dispatch.note };
       return { state: "skipped", ...sha ? { sha } : {}, note: "registry-publish deploys by publishing \u2014 the release-event publish.yml run is the deploy plane" };
+    }
     case "tenant-container":
     case "solo-container":
     case "static-cdn":
@@ -20656,6 +20712,7 @@ function releasePhaseInputsFromDispatch(model, dispatch, publishDispatch, publis
 function phaseInputsFromRunRows(model, rows, tagSha, opts = {}) {
   const deployRun = rows.find((r) => r.workflow === "deploy.yml");
   const publishRun = rows.find((r) => r.workflow === "publish.yml");
+  const hostRun = rows.find((r) => r.workflow === "jerv-gateway");
   switch (model) {
     case "hub-serverless":
       return {
@@ -20674,7 +20731,9 @@ function phaseInputsFromRunRows(model, rows, tagSha, opts = {}) {
       };
     case "registry-publish":
       return {
-        deploy: { state: "skipped", sha: tagSha, note: "registry-publish deploys by publishing \u2014 the release-event publish.yml run is the deploy plane" },
+        // #884/#6145: an operator-host deploy leg (Jerv-Hub's Gateway) outranks 'skipped' here exactly as
+        // in deployPhaseInput — it carries no runId, so no run metadata and no resume re-verification.
+        deploy: hostRun ? { state: runRowState(hostRun, "pending"), sha: tagSha, workflow: hostRun.workflow, note: "jerv-gateway operator-host deploy on the release SHA" } : { state: "skipped", sha: tagSha, note: "registry-publish deploys by publishing \u2014 the release-event publish.yml run is the deploy plane" },
         publish: publishRun ? {
           state: runRowState(publishRun, "pending"),
           sha: tagSha,
@@ -21041,12 +21100,14 @@ async function selfConvergeTrainCli(input) {
 var TRAIN_LANES = ["release", "rcand", "hotfix"];
 var TROUBLESHOOTING_GUIDE = "docs/Guides/train-troubleshooting.md";
 var SCRATCH_BRANCH_GLOBS = ["train/check/*", "hotfix-fold/*--port-*"];
+var COMPOSE_GUARD_HARD_FAIL = /^secrets preflight: .*noEnvFile is (not )?true.*$/m;
 function readLocalWorkflowsDefault(root) {
   const dir = (0, import_node_path22.join)(root, ".github", "workflows");
   let names;
   try {
     names = (0, import_node_fs23.readdirSync)(dir);
-  } catch {
+  } catch (e) {
+    if (e.code === "ENOENT") return [];
     return null;
   }
   const files = [];
@@ -21276,12 +21337,12 @@ async function runTrainDoctor(input) {
       ...!hints.hasMainBranch ? ["main"] : [],
       ...!hints.hasRcBranch && track === "full" ? ["rc"] : []
     ];
-    if (missing.length) add({ code: "bootstrap-gap", severity: "blocker", source: "origin", title: `train branch(es) missing on origin: ${missing.join(", ")}`, remedy: `bootstrap the repo train: \`mmi-cli bootstrap apply ${repo} --execute\` (from the MMI-Hub root), then rerun` });
+    if (missing.length) add({ code: "bootstrap-gap", severity: "blocker", source: "origin", title: `train branch(es) missing on origin: ${missing.join(", ")}`, remedy: `bootstrap the repo train: \`mmi-cli devops bootstrap apply ${repo} --execute\` (from the MMI-Hub root), then rerun` });
   }
   try {
     const required = await discoverRequiredCheckContexts(train, ctx, stage);
     if (required.length === 0) {
-      add({ code: "bootstrap-gap", severity: "blocker", source: "origin", title: `no ruleset requires a status check on ${stage} \u2014 the train would tag without a gate`, remedy: `activate the product ruleset: \`mmi-cli bootstrap apply ${repo} --execute\` (from the MMI-Hub root), or \`mmi-cli devops ci audit --repo ${repo}\`` });
+      add({ code: "bootstrap-gap", severity: "warning", source: "origin", title: `no ruleset requires a status check on ${stage} \u2014 the train tags without a check wait (the GitHub push gate is the backstop)`, remedy: `activate the product ruleset: \`mmi-cli devops bootstrap apply ${repo} --execute\` (from the MMI-Hub root), or \`mmi-cli devops ci audit --repo ${repo}\`` });
     } else {
       try {
         assertTagAddressableRequiredContexts({ readWorkflows: () => workflows }, required, repo);
@@ -21353,12 +21414,14 @@ async function runTrainDoctor(input) {
     }
   }
   try {
-    await train.runSelf(["secrets", "preflight", "--stage", stage, "--repo", repo]);
+    await train.runSelf(["secrets", "preflight", "--stage", stage, "--repo", repo, ...lane === "hotfix" ? ["--lane", "hotfix"] : []]);
   } catch (e) {
     const err = e;
     const text = [typeof err.stdout === "string" ? err.stdout : "", typeof err.stderr === "string" ? err.stderr : "", message(e)].join("\n");
     if (/^missing /m.test(text)) {
-      add({ code: "secrets-missing", severity: "blocker", source: "origin", title: `required ${stage} secret name(s) are absent: ${clean2(text.match(/^missing .*$/m)?.[0] ?? "")}`, remedy: `provision them in the vault (\`mmi-cli vault secrets request <KEY> --repo ${repo}\`), then rerun \`mmi-cli vault secrets preflight --stage ${stage} --repo ${repo}\`` });
+      add({ code: "secrets-missing", severity: "blocker", source: "origin", title: `required ${stage} secret name(s) are absent: ${clean2(text.match(/^missing .*$/m)?.[0] ?? "")}`, remedy: `provision them in the vault (\`mmi-cli vault secrets request <KEY> --repo ${repo}\`), then rerun \`mmi-cli vault secrets preflight --stage ${stage} --repo ${repo}${lane === "hotfix" ? " --lane hotfix" : ""}\`` });
+    } else if (COMPOSE_GUARD_HARD_FAIL.test(text)) {
+      add({ code: "compose-guard-mismatch", severity: "blocker", source: "origin", title: clean2(text.match(COMPOSE_GUARD_HARD_FAIL)?.[0] ?? text), remedy: `fix the compose/DEPLOY#${stage}.noEnvFile pair per the fileless-transition guide the preflight printed, then rerun \`mmi-cli vault secrets preflight --stage ${stage} --repo ${repo}${lane === "hotfix" ? " --lane hotfix" : ""}\`; --skip-compose-guard only after independent verification (#2813)` });
     } else {
       unverified(`the ${stage} secrets preflight`, clean2(text) || e);
     }
@@ -21548,7 +21611,7 @@ function enforceGateBudget(deps, repo) {
     );
   }
 }
-async function preflight(deps, ctx, stage, meta) {
+async function preflight(deps, ctx, stage, meta, lane) {
   const model = requireDeployModel(meta, ctx.repo);
   if (model === "content") {
     throw new Error(`${ctx.repo} is a content repo (deployModel=content) \u2014 the release train does not apply (trunk-based; PR to main)`);
@@ -21556,7 +21619,7 @@ async function preflight(deps, ctx, stage, meta) {
   if (model === "none") {
     throw new Error(`${ctx.repo} is not Hub-deployed (deployModel=none) \u2014 the release train does not apply; use the project's own release path`);
   }
-  await deps.runSelf(["secrets", "preflight", "--stage", stage, "--repo", ctx.repo]);
+  await deps.runSelf(["secrets", "preflight", "--stage", stage, "--repo", ctx.repo, ...lane === "hotfix" ? ["--lane", "hotfix"] : []]);
   await assertNpmMajorPreflightFromWorkflows(deps, ctx.repo);
   await assertActionsJobsCanStart(deps, ctx.repo);
   enforceGateBudget(deps, ctx.repo);
@@ -22202,7 +22265,7 @@ ${recovery.note}`), recoveryInput);
   const deployRunRepo = releaseRunRepoFor(deployModel, ctx.repo);
   const failedReleaseRun = deployDispatch0.workflowRuns?.find((run) => run.conclusion === "failure");
   const dispatchFailurePhase = failedReleaseRun?.workflow === "publish.yml" || deployModel === "registry-publish" ? "publish" : "deploy";
-  const deployDispatch = await recoverFailedDispatchPhase(
+  const recoveredDeployDispatch = await recoverFailedDispatchPhase(
     deps,
     ledger,
     ledgerAnchors,
@@ -22215,6 +22278,7 @@ ${recovery.note}`), recoveryInput);
       workflow: failedReleaseRun?.workflow ?? (isCentralDispatchModel(deployModel) ? "tenant-deploy.yml" : "deploy workflow")
     }
   );
+  const deployDispatch = await appendJervGatewayReleaseDeploy(deps, ctx.repo, tag, releaseSha, recoveredDeployDispatch);
   await recordPhase(ledger, deps, ledgerAnchors, "deploy", phaseEntry(deployPhaseInput(deployModel, deployDispatch, { releaseSha })), {
     landed: "the immutable tag, the green required-check wall, the origin/main fast-forward, and the verified GitHub Release"
   });
@@ -22239,7 +22303,6 @@ ${recovery.note}`), recoveryInput);
     landed: "the immutable tag, the green required-check wall, origin/main, the verified GitHub Release, and the dispatched deploy path"
   });
   let dispatch = appendPublishDispatch(deployDispatch, publishDispatch);
-  dispatch = await appendJervGatewayReleaseDeploy(deps, ctx.repo, tag, releaseSha, dispatch);
   if (publishSkipNote) dispatch = { ...dispatch, note: `${dispatch.note}; tenant-publish.yml skipped (${publishSkipNote})` };
   return { checks, releaseUrl, announceNote, dispatch, ledgerAnchors };
 }
@@ -22515,17 +22578,18 @@ Nothing was written. Inspect ${ledger.path} (or clear it only after proving the
       historicalDeploy = historicalTargets.length ? aggregateWorkflowRuns(historicalRows) : recovered.deployStatus;
       historicalNote = recovered.note;
     }
+    const dispatch2 = await appendJervGatewayReleaseDeploy(deps, ctx.repo, tag, tagSha, {
+      note: historicalNote,
+      deployStatus: historicalDeploy,
+      workflowRuns: historicalRows
+    });
     if (persisted) {
-      const phaseInputs = phaseInputsFromRunRows(deployModel, historicalRows, tagSha, { repo: ctx.repo });
+      const phaseInputs = phaseInputsFromRunRows(deployModel, dispatch2.workflowRuns ?? historicalRows, tagSha, { repo: ctx.repo });
       await recordPhase(ledger, deps, anchors, "deploy", phaseEntry(phaseInputs.deploy), { strict: true, landed: "the verified GitHub Release and origin/main at the immutable tag SHA" });
       await recordPhase(ledger, deps, anchors, "publish", phaseEntry(phaseInputs.publish), { strict: true, landed: "the verified GitHub Release and origin/main at the immutable tag SHA" });
       await recordPhase(ledger, deps, anchors, "githubRelease", phaseEntry({ state: "complete", sha: tagSha, note: "re-verified live: the GitHub Release exists at the immutable tag SHA" }), { strict: true, landed: "the promotion (verified live)" });
       await recordPhase(ledger, deps, anchors, "promotion", phaseEntry({ state: "complete", sha: tagSha, note: "re-verified live: origin/main contains the immutable tag SHA" }), { strict: true, landed: "nothing beyond the already-public release" });
     }
-    const dispatch2 = await appendJervGatewayReleaseDeploy(deps, ctx.repo, tag, tagSha, {
-      note: historicalNote,
-      deployStatus: historicalDeploy
-    });
     if (isJervHubRepo(ctx.repo)) steps2.push(dispatch2.note);
     if (persisted) {
       await recordPhase(ledger, deps, anchors, "alignment", phaseEntry(alignmentPhaseEntry(devRollForward2, rcAlignment2)), { strict: true, landed: "the released, verified, deploy-resolved release (alignment PRs reused/landed)" });
@@ -22607,7 +22671,7 @@ ${recovery.note}`), recoveryInput);
   const announceNote = deps.announce ? (await deps.announce({ repo: ctx.repo, tag, summaryFile: options.announceSummaryFile })).note : void 0;
   const autoRunSince = (deps.now ?? Date.now)();
   const deployDispatch0 = await dispatchDeploy(deps, ctx, "main", "main", deployModel, watch, autoRunSince, tagSha, "report", meta.publishDir);
-  const deployDispatch = await recoverFailedDispatchPhase(
+  const recoveredDeployDispatch = await recoverFailedDispatchPhase(
     deps,
     ledger,
     anchors,
@@ -22620,6 +22684,7 @@ ${recovery.note}`), recoveryInput);
       workflow: isCentralDispatchModel(deployModel) ? "tenant-deploy.yml" : "deploy workflow"
     }
   );
+  const deployDispatch = await appendJervGatewayReleaseDeploy(deps, ctx.repo, tag, tagSha, recoveredDeployDispatch);
   steps.push(`dispatched the ${deployModel} deploy path`);
   await recordPhase(ledger, deps, anchors, "deploy", phaseEntry(deployPhaseInput(deployModel, deployDispatch, { releaseSha: tagSha })), {
     strict: ledgerMode === "strict",
@@ -22638,8 +22703,7 @@ ${recovery.note}`), recoveryInput);
     strict: ledgerMode === "strict",
     landed: "the immutable tag, the re-proven wall, origin/main, the verified GitHub Release, and the dispatched deploy path"
   });
-  let dispatch = appendPublishDispatch(deployDispatch, publishDispatch);
-  dispatch = await appendJervGatewayReleaseDeploy(deps, ctx.repo, tag, tagSha, dispatch);
+  const dispatch = appendPublishDispatch(deployDispatch, publishDispatch);
   const devRollForward = await rollDevelopmentForward(deps, ctx, tag);
   steps.push(`development roll-forward: ${devRollForward.status}`);
   const rcAlignment = !directTrack && branchHints.hasRcBranch ? await alignRcForward(deps, ctx, tag) : void 0;
@@ -25264,6 +25328,13 @@ function registerBoardCommands(program3) {
     const lane = holder.surface && holder.session && holder.host ? ` (${holder.surface}/${holder.session}@${holder.host})` : "";
     return `@${holder.login}${lane}`;
   }
+  function printClaimWarnings(warnings, toStderr = false) {
+    for (const warning of warnings ?? []) {
+      if (toStderr) process.stderr.write(`Warning: ${warning}
+`);
+      else console.log(`Warning: ${warning}`);
+    }
+  }
   function claimVerdict(ref, result) {
     const holder = formatClaimHolder(result.holder);
     const previousHolder = result.previousHolder ? formatClaimHolder(result.previousHolder) : "another lane";
@@ -25286,24 +25357,26 @@ function registerBoardCommands(program3) {
   const board = program3.command("board").description("read, claim, show, and move Project v2 work items for the current repo");
   board.command("read", { isDefault: true }).alias("list").description("read the board and print user-owned, claimable, and taken items").option("--json", "machine-readable output").option("--repo <owner/repo>", "current repo (defaults to git origin)").option("--direct", "bypass the Hub snapshot and read the live board through direct GitHub GraphQL").option("--bundle-details", "fetch body/comments only for user-owned and claimable issues").option("--bodies", "fetch body/comments for EVERY scoped row, including taken and unowned in-flight ones \u2014 for consumers that scope by Status rather than ownership (#4861); implies --bundle-details and costs one extra read per row").option("--allow-partial", "return partial board results when later page/detail reads fail").option("--out <path>", "write the output to this file as UTF-8 (no BOM) instead of stdout \u2014 the shell-free receipt path (#5802)").addHelpText("after", "\nread is always the authoritative live GitHub Project v2 board (#4926).\n--direct skips the Hub snapshot and uses the existing direct GitHub GraphQL read immediately.\n--allow-partial applies to the paginated path and detail reads.\n\nNever capture the JSON with a shell redirect on Windows: PowerShell 5.1's `> file.json` is Out-File,\nwhich writes UTF-16LE with a BOM, and Node reading it as 'utf8' then fails JSON.parse at position 1\n(#5802). Use --out instead \u2014 the CLI writes the file itself as UTF-8:\n  mmi-cli oracle board read --json --out .jerv/tmp/board.json\n").action((o) => runBoardRead(o));
   withExamples(mutating(
-    board.command("claim <issues...>").description("claim issues: assign them and move their Project v2 Status to In Progress \u2014 idempotent, so an item already yours and In Progress succeeds unchanged (one or more refs)").addHelpText("after", "\nevery claim stamps a lane-identity marker comment on the issue (`<!-- mmi-claim: \u2026 -->`,\nsurface/session@host) so other agents can attribute the hold (#3727). The session is the\nhost-exported id when the surface provides one, otherwise a per-process `synth-` fallback \u2014\na claim is never anonymous (#5245). `board show`, doctor and unclaim read the latest marker.\n\nsame-owner resume (#6035): when the prior marker was posted by YOUR login on THIS host and its\nlocal session is verifiably dead (transcript probe), the claim proceeds as a resume without\n--force and names the evidence. A live, foreign-host, or unprobeable prior lane still refuses.\n").option("--json", "machine-readable output").option("--repo <owner/repo>", "current repo for local issue numbers (defaults to git origin)").option("--for <login>", "assign to this login instead of @me \u2014 agent claims on behalf of the master").option("--force", "take an item already claimed by another lane that shows live evidence of active work (#3727)").option("--check", "read-only: run every claim gate and report the verdict, writing nothing \u2014 exits 1 with the same refusal a real claim would raise (#4511)").option("--allow-partial", "return success JSON if assignment succeeds but the status move fails"),
+    board.command("claim <issues...>").description("claim issues: assign them and move their Project v2 Status to In Progress \u2014 idempotent, so an item already yours and In Progress succeeds unchanged (one or more refs); the board scan rides the Hub snapshot, same as board read").addHelpText("after", "\nclaim reads the board through the same Hub snapshot leg as `board read` (the App-installation\ncredential, never your personal GraphQL pool); the direct user-auth read is an emergency fallback\nand is named in a Warning line after the verdict (#6162).\n\nevery claim stamps a lane-identity marker comment on the issue (`<!-- mmi-claim: \u2026 -->`,\nsurface/session@host) so other agents can attribute the hold (#3727). The session is the\nhost-exported id when the surface provides one, otherwise a per-process `synth-` fallback \u2014\na claim is never anonymous (#5245). `board show`, doctor and unclaim read the latest marker.\n\nsame-owner resume (#6035): when the prior marker was posted by YOUR login on THIS host and its\nlocal session is verifiably dead (transcript probe), the claim proceeds as a resume without\n--force and names the evidence. A live, foreign-host, or unprobeable prior lane still refuses.\n").option("--json", "machine-readable output").option("--repo <owner/repo>", "current repo for local issue numbers (defaults to git origin)").option("--for <login>", "assign to this login instead of @me \u2014 agent claims on behalf of the master").option("--force", "take an item already claimed by another lane that shows live evidence of active work (#3727)").option("--check", "read-only: run every claim gate and report the verdict, writing nothing \u2014 exits 1 with the same refusal a real claim would raise (#4511)").option("--allow-partial", "return success JSON if assignment succeeds but the status move fails"),
     (_opts, args) => ({ command: "board claim", issues: args[0] ?? [] })
   ).action(async (issueRefs, o) => {
     if (issueRefs.length === 1) {
       const issueRef = issueRefs[0];
       try {
+        const config = await loadConfigForBoardSelector2(issueRef, o.repo);
         const result = await claimBoardIssue({
-          config: await loadConfigForBoardSelector2(issueRef, o.repo),
+          config,
           selector: issueRef,
           repo: o.repo,
           assignee: o.for,
           force: o.force,
           check: o.check,
           allowPartial: o.allowPartial
-        });
+        }, { snapshot: registryClientDeps(config) });
         if (!result.checked) invalidateStatuslineBoardCache();
         if (o.json) return console.log(JSON.stringify(result));
         console.log(claimVerdict(result.item.ref, result));
+        printClaimWarnings(result.warnings);
       } catch (e) {
         if (refuseRateLimited(e, o.json)) return;
         return failGraceful(`board claim failed: ${e.message}`);
@@ -25311,22 +25384,25 @@ function registerBoardCommands(program3) {
       return;
     }
     try {
+      const config = await loadConfigForBoardSelector2(issueRefs[0], o.repo);
       const bulk = await claimBoardIssues({
-        config: await loadConfigForBoardSelector2(issueRefs[0], o.repo),
+        config,
         selectors: issueRefs,
         repo: o.repo,
         assignee: o.for,
         force: o.force,
         check: o.check,
         allowPartial: o.allowPartial
-      });
+      }, { snapshot: registryClientDeps(config) });
       if (bulk.results.some((r) => r.claimed && !r.checked)) invalidateStatuslineBoardCache();
       if (o.json) {
         console.log(JSON.stringify(bulk.results));
+        printClaimWarnings(bulk.warnings, true);
       } else {
         for (const result of bulk.results) {
           console.log(result.claimed ? claimVerdict(result.ref, result) : `Skipped ${result.ref}: ${result.reason}`);
         }
+        printClaimWarnings(bulk.warnings);
       }
       if (bulk.failed > 0) process.exitCode = 1;
     } catch (e) {
@@ -25639,7 +25715,7 @@ function trainPlan(command, options = {}) {
     { label: "verify the fix is merged on development (the only hotfix origin)", gated: true },
     // #6068: hotfix start/release run the SAME shared preflight as release/rcand, before any git mutation.
     { label: "verify registry META for this project", command: "mmi-cli oracle org project get <owner/repo>", gated: true },
-    { label: "preflight required main secret names", command: "mmi-cli vault secrets preflight --stage main --repo <owner/repo>", gated: true },
+    { label: "preflight required main secret names", command: "mmi-cli vault secrets preflight --stage main --repo <owner/repo> --lane hotfix", gated: true },
     { label: "preflight local npm major vs the CI-declared npm, GitHub Actions hosted job start (billing/spending), and the gate wall-clock budget", command: "shared train preflight (#5666/#5604/#3178) \u2014 runs inside hotfix start and hotfix release", gated: true },
     { label: "refuse on a prior pending/failed train ledger leg (release, rcand or hotfix) before mutating anything", command: "shared release ledger (#5987/#6068) \u2014 finish that run first", gated: true },
     { label: "branch hotfix from main and cherry-pick the dev commits", command: "git cherry-pick -x <dev-sha>", gated: true },
@@ -28247,7 +28323,7 @@ function formatDeployStatus(r) {
     `running version: ${r.runningVersion ?? "none stamped"}`,
     `last deploy run: ${formatLastRun(r)}`,
     `public URL: ${r.publicUrl ?? "none"}`,
-    `health probe: ${r.health ? `${r.health.ok ? "ok" : "failed"}${r.health.status ? ` (HTTP ${r.health.status})` : ""}${r.health.error ? ` \u2014 ${r.health.error}` : ""}` : "not probed"}`,
+    `health probe: ${r.health ? `${r.health.ok ? "ok" : "failed"}${r.health.status ? ` (HTTP ${r.health.status})` : ""}${r.health.error ? ` \u2014 ${r.health.error}` : ""}${r.health.url && r.health.url !== r.publicUrl ? ` at ${r.health.url}` : ""}` : "not probed"}`,
     `deploy state: ${r.deployOk === void 0 ? "not stamped" : r.deployOk ? "ok" : "failed"}`
   ];
   if (r.hints.length) {
@@ -28258,22 +28334,9 @@ function formatDeployStatus(r) {
 
 // src/deploy-commands.ts
 var STAGES2 = ["dev", "rc", "main"];
-async function probeHttpBounded(url, timeoutMs = 5e3) {
-  const controller = new AbortController();
-  const timeout = setTimeout(() => controller.abort(), timeoutMs);
-  timeout.unref?.();
-  try {
-    const res = await fetch(url, { method: "GET", signal: controller.signal });
-    return { ok: res.ok, status: res.status };
-  } catch (e) {
-    return { ok: false, error: e.message };
-  } finally {
-    clearTimeout(timeout);
-  }
-}
 function registerDeployCommands(program3) {
   const deploy = program3.command("deploy").description("per-stage deploy observability \u2014 last run, health, and running version (#2688)");
-  deploy.command("status <stage>").description("last deploy run + runtime health probe + running version for a stage (defaults to the current repo)").option("--repo <owner/repo>", "target repo (defaults to the current repo)").option("--json", "machine-readable output").action(async (stage, o) => {
+  deploy.command("status <stage>").description("last deploy run + runtime health probe + running version for a stage (defaults to the current repo); an auth-walled root (401/403) is re-probed at /health and the `url` field names the endpoint that answered (#6137)").option("--repo <owner/repo>", "target repo (defaults to the current repo)").option("--json", "machine-readable output").action(async (stage, o) => {
     if (!STAGES2.includes(stage)) {
       return fail(`runtime deploy status: <stage> must be dev, rc, or main`);
     }
@@ -28285,7 +28348,7 @@ function registerDeployCommands(program3) {
       const deployFacts = await fetchDeployFactsBySlug(slug, reg);
       const publicUrl = publicUrlFromDeployFact(deployFacts?.stages[stage] ?? null);
       const [health, lastRun] = await Promise.all([
-        publicUrl ? probeHttpBounded(publicUrl) : Promise.resolve(void 0),
+        publicUrl ? probePublicHealth(publicUrl) : Promise.resolve(void 0),
         fetchLastTenantDeployRun(slug, stage)
       ]);
       const report = buildDeployStatusReport({
@@ -29016,7 +29079,8 @@ function composeMarksRuntimeEnvTrue(composeText) {
     return false;
   });
 }
-function promotionSourceBranch(stage, releaseTrack) {
+function promotionSourceBranch(stage, releaseTrack, lane) {
+  if (lane === "hotfix") return "main";
   if (stage === "main") return releaseTrack === "direct" ? "development" : "rc";
   return "development";
 }
@@ -29917,7 +29981,7 @@ async function collectStatus() {
   try {
     const cfg = await loadConfigOrDiscover();
     if (cfg.sagaApiUrl) {
-      const report = await readBoard({ config: cfg });
+      const report = await readBoard({ config: cfg }, { snapshot: registryClientDeps(cfg) });
       claimedItems = report.primary.userOwned.map((item) => ({
         number: item.number,
         title: item.title,
@@ -29964,8 +30028,8 @@ var PRIORITY_RANK = {
 };
 async function recommendNext(repo, deps) {
   const load = deps?.loadConfig ?? loadConfigForRepo;
-  const reader = deps?.readBoard ?? readBoard;
   const cfg = await load(repo);
+  const reader = deps?.readBoard ?? ((opts) => readBoard(opts, { snapshot: registryClientDeps(cfg) }));
   if (!cfg.sagaApiUrl) throw new Error("Hub API URL not configured \u2014 the board was NOT read (run `mmi-cli doctor`)");
   let report;
   try {
@@ -30011,7 +30075,7 @@ async function collectOnboardStatus(opts = {}) {
   let board = { ok: false, detail: "no config" };
   try {
     if (cfg.sagaApiUrl) {
-      const report = await readBoard({ config: cfg });
+      const report = await readBoard({ config: cfg }, { snapshot: registryClientDeps(cfg) });
       const total = report.primary.claimable.length + report.primary.userOwned.length + report.primary.taken.length;
       board = { ok: true, detail: `board has ${total} active items (${report.primary.claimable.length} claimable, ${report.primary.userOwned.length} yours)` };
     } else {
@@ -30230,14 +30294,6 @@ var surfaces_default = {
             sourcePath: "skills",
             targetPath: "packages/claude-plugin/skills"
           },
-          {
-            mode: "files",
-            sourcePath: "scripts",
-            targetPath: "packages/claude-plugin/scripts",
-            include: [
-              "edit-tool-paths.mjs"
-            ]
-          },
           {
             mode: "files",
             sourcePath: "bin",
@@ -30313,14 +30369,6 @@ var surfaces_default = {
             sourcePath: "skills",
             targetPath: "packages/codex-plugin/skills"
           },
-          {
-            mode: "files",
-            sourcePath: "scripts",
-            targetPath: "packages/codex-plugin/scripts",
-            include: [
-              "edit-tool-paths.mjs"
-            ]
-          },
           {
             mode: "files",
             sourcePath: "bin",
@@ -30396,14 +30444,6 @@ var surfaces_default = {
             sourcePath: "skills",
             targetPath: "packages/cursor-plugin/skills"
           },
-          {
-            mode: "files",
-            sourcePath: "scripts",
-            targetPath: "packages/cursor-plugin/scripts",
-            include: [
-              "edit-tool-paths.mjs"
-            ]
-          },
           {
             mode: "files",
             sourcePath: "bin",
@@ -30482,14 +30522,6 @@ var surfaces_default = {
             excludeNamePrefixes: [
               "_"
             ]
-          },
-          {
-            mode: "files",
-            sourcePath: "scripts",
-            targetPath: ".pi-plugin/scripts",
-            include: [
-              "edit-tool-paths.mjs"
-            ]
           }
         ]
       },
@@ -30549,14 +30581,6 @@ var surfaces_default = {
             mode: "directories",
             sourcePath: "skills",
             targetPath: "packages/hermes-plugin/skills"
-          },
-          {
-            mode: "files",
-            sourcePath: "scripts",
-            targetPath: "packages/hermes-plugin/scripts",
-            include: [
-              "edit-tool-paths.mjs"
-            ]
           }
         ]
       },
@@ -32612,6 +32636,10 @@ function validateBatchSpecs(specs) {
       spec.labels = [...spec.labels ?? [], ...alias];
       delete spec.label;
     }
+    if (spec.labels !== void 0 && (!Array.isArray(spec.labels) || spec.labels.some((l) => typeof l !== "string" || !l.trim()))) {
+      errors.push({ row, error: "labels must be an array of non-empty strings" });
+      continue;
+    }
     if (spec.repo !== void 0 && !/^[\w.-]+\/[\w.-]+$/.test(spec.repo)) {
       errors.push({ row, error: `bad repo "${spec.repo}" \u2014 expected owner/repo` });
       continue;
@@ -32620,13 +32648,17 @@ function validateBatchSpecs(specs) {
       errors.push({ row, error: `unknown type "${spec.type}" \u2014 expected one of: ${validTypes.join(", ")}` });
       continue;
     }
-    if (!spec.title || !spec.title.trim()) {
+    if (typeof spec.title !== "string" || !spec.title.trim()) {
       errors.push({ row, error: "missing or empty title" });
       continue;
     }
+    if (spec.body !== void 0 && typeof spec.body !== "string") {
+      errors.push({ row, error: "body must be a string" });
+      continue;
+    }
     let priority;
     try {
-      priority = spec.priority ? normalizePriority(spec.priority) : "medium";
+      priority = spec.priority ? normalizePriority(String(spec.priority)) : "medium";
     } catch (e) {
       errors.push({ row, error: e.message });
       continue;
@@ -32639,6 +32671,14 @@ function validateBatchSpecs(specs) {
       if (!labelsCarrySurface(spec.labels)) spec.labels = [...spec.labels ?? [], surfaceLabel(spec.surface)];
       delete spec.surface;
     }
+    if (spec.parent !== void 0) {
+      try {
+        parseIssueRef(spec.parent);
+      } catch (e) {
+        errors.push({ row, error: e.message });
+        continue;
+      }
+    }
     validated.push({ row, spec, priority, type: spec.type });
   }
   return { ok: errors.length === 0, errors, validated };
@@ -34065,6 +34105,8 @@ var UPDATE_PROJECT_INFO = `mutation($projectId: ID!, $shortDescription: String!,
     projectV2 { id }
   }
 }`;
+var ProjectInfoReadUnavailableError = class extends Error {
+};
 function shortDescriptionFromReadme(markdown) {
   const lines2 = markdown.replace(/\r/g, "").split("\n");
   const h1 = lines2.findIndex((line) => /^#\s+\S/.test(line.trim()));
@@ -34786,10 +34828,13 @@ function registerSecretsCommands(program3) {
     const ok = body !== void 0 ? await secretsOrgCatalogSet(d, body, { replace: o.replace, remove: o.remove }) : await secretsOrgCatalogRemove(d, o.remove ?? []);
     if (!ok) process.exitCode = 1;
   }));
-  secrets.command("preflight").description("check required stage secret names for a deploy/train without reading values").requiredOption("--stage <dev|rc|main>", "stage to check").option("--repo <owner/repo>", "target repo (defaults to the current repo)").option("--required <KEY...>", "required keys; bare keys are scoped under --stage").option("--skip-compose-guard", "skip the #2813 fileless-compose \u2194 DEPLOY#.noEnvFile promotion guard").option("--json", "machine-readable output").action(async (o) => {
+  secrets.command("preflight").description("check required stage secret names for a deploy/train without reading values").requiredOption("--stage <dev|rc|main>", "stage to check").option("--repo <owner/repo>", "target repo (defaults to the current repo)").option("--required <KEY...>", "required keys; bare keys are scoped under --stage").option("--skip-compose-guard", "skip the #2813 fileless-compose \u2194 DEPLOY#.noEnvFile promotion guard").option("--lane <hotfix>", "only hotfix is accepted: the hotfix lane deploys main, so the #2813 guard reads main, not rc (#6136); release/rcand need no flag").option("--json", "machine-readable output").action(async (o) => {
     if (!["dev", "rc", "main"].includes(o.stage)) {
       return fail("secrets preflight: --stage must be dev, rc, or main");
     }
+    if (o.lane !== void 0 && o.lane !== "hotfix") {
+      return fail("secrets preflight: --lane must be hotfix (the only lane that changes the compose source)");
+    }
     const cfg = await loadConfig();
     if (!cfg.sagaApiUrl) {
       fail("secrets: Hub API URL not configured");
@@ -34810,7 +34855,7 @@ function registerSecretsCommands(program3) {
     let filelessOk = true;
     if (meta && centralContainer && !o.skipComposeGuard) {
       const stage = o.stage;
-      const branch = promotionSourceBranch(stage, resolveReleaseTrack(meta, void 0, repo));
+      const branch = promotionSourceBranch(stage, resolveReleaseTrack(meta, void 0, repo), o.lane);
       const cwdRepo = repoFromRemoteUrl((await execFileP("git", ["remote", "get-url", "origin"]).catch(() => ({ stdout: "" }))).stdout);
       const { sameRepo: sameRepo2 } = resolvePreflightRepoScope(o.repo, cwdRepo);
       const facts = await fetchDeployFactsBySlug(slug, regDeps);
@@ -35016,10 +35061,11 @@ async function resolveBoardConfig2(repoOption) {
   const floor = await loadConfig();
   if (!floor.sagaApiUrl) return null;
   const slug = repoOption ? (repoOption.replace(/\.git$/, "").split("/").pop() ?? repoOption).toLowerCase() : await repoSlug();
-  const read = await fetchProjectBySlugChecked(slug, registryClientDeps(floor));
+  const registry2 = registryClientDeps(floor);
+  const read = await fetchProjectBySlugChecked(slug, registry2);
   if (!read.ok || !read.project) return null;
   const cfg = boardConfigFromProject(read.project, floor);
-  return readBoard({ config: cfg, repo: repoOption, allowPartial: true });
+  return readBoard({ config: cfg, repo: repoOption, allowPartial: true }, { snapshot: registry2 });
 }
 function registerSessionReport(program3) {
   const report = program3.commands.find((c) => c.name() === "report");
@@ -36788,24 +36834,31 @@ function runTestPolicy(root, deps = {}) {
 ` + (deps.base === HOTFIX_DIFF_BASE ? `  Hotfix lane (--base ${HOTFIX_DIFF_BASE}): pass --policy-ref <exact-${HOTFIX_POLICY_REF}-commit> so the current policy is read from ${HOTFIX_POLICY_REF}.` : `  Restore ${POLICY_FILE} on this branch; the policy file belongs on every non-hotfix lane.`)
   }] : [];
   const present = (path2) => exists((0, import_node_path33.join)(root, path2));
+  const policyTree = policySource.sha ? new Set(git2(["ls-tree", "-r", "-z", "--name-only", policySource.sha], root).split("\0").filter(Boolean).map((p) => (0, import_node_path33.join)(root, p))) : null;
+  const policyTreeExists = policyTree ? (abs) => policyTree.has(abs) : exists;
+  const where = policySource.sha ? `${policySource.ref}@${policySource.sha}` : "this worktree";
   const removedByThisDiff = removedPaths(changed);
   const staleFindings = [];
-  const unresolved = unresolvedProtectedEntries(policy, root, exists).filter((p) => !removedByThisDiff.has(p));
+  const unresolved = unresolvedProtectedEntries(policy, root, policyTreeExists).filter((p) => !removedByThisDiff.has(p));
   if (unresolved.length > 0) {
     staleFindings.push({
       kind: "stale-protected-entry",
       paths: unresolved,
-      detail: `STALE PROTECTED ENTRY \u2014 test-policy.json protects ${unresolved.length} path(s) that do not exist:
-` + unresolved.map((p) => `    ${p}`).join("\n") + "\n  An entry naming a missing file reads as protection while protecting nothing.\n  Restore the file, or remove its entry."
+      detail: `STALE PROTECTED ENTRY \u2014 test-policy.json protects ${unresolved.length} path(s) that do not exist on ${where}:
+` + unresolved.map((p) => `    ${p}`).join("\n") + `
+  An entry naming a missing file reads as protection while protecting nothing.
+  Restore the file on ${where}, or remove its entry.`
     });
   }
-  const staleSatisfiers = unresolvedSatisfiers(policy, root, exists).filter((p) => !removedByThisDiff.has(p));
+  const staleSatisfiers = unresolvedSatisfiers(policy, root, policyTreeExists).filter((p) => !removedByThisDiff.has(p));
   if (staleSatisfiers.length > 0) {
     staleFindings.push({
       kind: "stale-satisfied-by",
       paths: staleSatisfiers,
-      detail: `STALE STANDING COVERAGE \u2014 a mandatory glob claims ${staleSatisfiers.length} path(s) as satisfiedBy that do not exist:
-` + staleSatisfiers.map((p) => `    ${p}`).join("\n") + "\n  A glob discharged by coverage that is not there is a glob enforcing nothing, quietly.\n  Restore the file, or drop it from satisfiedBy so the glob asks for a test again."
+      detail: `STALE STANDING COVERAGE \u2014 a mandatory glob claims ${staleSatisfiers.length} path(s) as satisfiedBy that do not exist on ${where}:
+` + staleSatisfiers.map((p) => `    ${p}`).join("\n") + `
+  A glob discharged by coverage that is not there is a glob enforcing nothing, quietly.
+  Restore the file on ${where}, or drop it from satisfiedBy so the glob asks for a test again.`
     });
   }
   const override = lookup.override;
@@ -37120,15 +37173,17 @@ function cleanupGitArgs(cwd, args) {
 }
 async function remoteBranchExists2(branch, options = {}) {
   if (!branch) return void 0;
+  const remote = options.remote ?? "origin";
   try {
-    if (options.prune) await execFileP("git", cleanupGitArgs(options.cwd, ["fetch", "origin", "--prune"]), { timeout: GIT_TIMEOUT_MS });
-    return (await execFileP("git", cleanupGitArgs(options.cwd, ["ls-remote", "--heads", "origin", branch]), { timeout: GIT_TIMEOUT_MS })).stdout.trim().length > 0;
+    if (options.prune) await execFileP("git", cleanupGitArgs(options.cwd, ["fetch", remote, "--prune"]), { timeout: GIT_TIMEOUT_MS });
+    return (await execFileP("git", cleanupGitArgs(options.cwd, ["ls-remote", "--heads", remote, branch]), { timeout: GIT_TIMEOUT_MS })).stdout.trim().length > 0;
   } catch {
     return void 0;
   }
 }
 async function deleteMergedRemoteBranch(options) {
-  const remediation = `git push origin --delete ${options.branch}`;
+  const remote = options.remote ?? "origin";
+  const remediation = `git push ${remote} --delete ${options.branch}`;
   if (!options.branch) {
     return {
       branch: options.branch,
@@ -37157,13 +37212,13 @@ async function deleteMergedRemoteBranch(options) {
         existedBefore: false,
         attempted: false,
         status: "failed",
-        error: `could not verify absence of origin/${options.branch}`,
+        error: `could not verify absence of ${remote}/${options.branch}`,
         remediation
       };
     }
   }
   try {
-    await options.execGit(["push", "origin", "--delete", options.branch]);
+    await options.execGit(["push", remote, "--delete", options.branch]);
   } catch (e) {
     const exists2 = await options.branchExists(options.branch);
     if (exists2 === false) {
@@ -37197,7 +37252,7 @@ async function deleteMergedRemoteBranch(options) {
     existedBefore: options.existedBefore,
     attempted: true,
     status: "failed",
-    error: exists ? `origin still reports ${options.branch} after deletion` : `could not verify deletion of origin/${options.branch}`,
+    error: exists ? `${remote} still reports ${options.branch} after deletion` : `could not verify deletion of ${remote}/${options.branch}`,
     remediation
   };
 }
@@ -37539,11 +37594,13 @@ async function prCreateClaimRefusal(body, repoOption, deps = {}) {
   const actor = deps.actor ?? describeSessionIdentity();
   const checkContest = deps.checkContest ?? checkLaneContest;
   for (const number of issues) {
+    const state = await client.rest("GET", `repos/${repo}/issues/${number}`).then((issue) => issue?.state, () => void 0);
+    if (state?.toLowerCase() === "closed") continue;
     const contest = await checkContest(client, { repository: repo, number }, actor);
     if (!contest.contested) continue;
     const ref = `${repo}#${number}`;
     const holder = contest.marker ? `lane ${describeClaimMarker(contest.marker)}` : "another lane";
-    return `pr create: REFUSED \u2014 ${ref} is held by ${holder} with live or unreadable work evidence; run \`mmi-cli oracle board claim ${ref} --force\` before creating this PR`;
+    return `pr create: REFUSED \u2014 ${ref} is held by ${holder} with live or unreadable work evidence; run \`mmi-cli oracle board claim ${ref} --force\` (move it to In Progress first if it sits In Review) or drop the closing line before creating this PR`;
   }
   return void 0;
 }
@@ -37845,9 +37902,9 @@ function isPathAtOrWithin(path2, worktreePath) {
 function isWindowsCwdLockResidueError(error) {
   return process.platform === "win32" && /\bEPERM\b|access(?: is)? denied/i.test(error);
 }
-function deferredCwdLockRemediation(primaryRoot, wtPath) {
+function deferredCwdLockRemediation(wtPath) {
   const quote = (path2) => path2.replace(/'/g, "''");
-  return `After this command exits: Set-Location -LiteralPath '${quote(primaryRoot)}'; Remove-Item -LiteralPath '${quote(wtPath)}' -Recurse -Force`;
+  return `After this command exits: jervcode worktree-cleanup --worktree '${quote(wtPath)}'`;
 }
 function primaryCheckoutBranchRemediation(primaryRoot, baseRef, branch) {
   const quote = (value) => value.replace(/'/g, "''");
@@ -37943,6 +38000,69 @@ function safeRemoveTree(path2) {
   }
   (0, import_node_fs41.unlinkSync)(path2);
 }
+function errorMessage(e) {
+  return e instanceof Error ? e.message : String(e);
+}
+function resolvedOrRaw(path2) {
+  try {
+    return normPath2((0, import_node_fs41.realpathSync)(path2));
+  } catch {
+    return normPath2(path2);
+  }
+}
+function unlinkEscapingReparsePoints(root, primaryRoot) {
+  let realRoot;
+  try {
+    if ((0, import_node_fs41.lstatSync)(root).isSymbolicLink()) {
+      return { ok: false, error: `delete root ${normPath2(root)} is a reparse point resolving to ${resolvedOrRaw(root)}` };
+    }
+    realRoot = normPath2((0, import_node_fs41.realpathSync)(root));
+  } catch (e) {
+    if (e.code === "ENOENT") return { ok: true, unlinked: [] };
+    return { ok: false, error: `cannot resolve delete root ${normPath2(root)}: ${errorMessage(e)}` };
+  }
+  const realPrimary = resolvedOrRaw(primaryRoot);
+  const forbidden = isPathAtOrWithin(realPrimary, realRoot) ? realPrimary : [`${realPrimary}/node_modules`, `${realPrimary}/packages`].find((p) => isPathAtOrWithin(realRoot, p));
+  if (forbidden) {
+    return { ok: false, error: `delete root ${normPath2(root)} (resolved ${realRoot}) is or contains the primary checkout path ${forbidden}` };
+  }
+  const unlinked = [];
+  const stack = [realRoot];
+  while (stack.length) {
+    const dir = stack.pop();
+    let entries;
+    try {
+      entries = (0, import_node_fs41.readdirSync)(dir, { withFileTypes: true });
+    } catch (e) {
+      return { ok: false, error: `cannot scan ${normPath2(dir)} for reparse points: ${errorMessage(e)}` };
+    }
+    for (const entry of entries) {
+      const child2 = (0, import_node_path38.join)(dir, entry.name);
+      if (entry.isSymbolicLink()) {
+        let target = "";
+        try {
+          target = normPath2((0, import_node_fs41.realpathSync)(child2));
+        } catch {
+          target = "";
+        }
+        if (target && isPathAtOrWithin(target, realRoot)) continue;
+        try {
+          safeRemoveTree(child2);
+        } catch (e) {
+          return { ok: false, error: `cannot unlink reparse point ${normPath2(child2)} -> ${target || "unresolvable"}: ${errorMessage(e)}` };
+        }
+        unlinked.push(normPath2(child2));
+        continue;
+      }
+      if (entry.isDirectory()) stack.push(child2);
+    }
+  }
+  return { ok: true, unlinked };
+}
+function reparseEscapeRemediation(wtPath) {
+  const quote = (value) => value.replace(/'/g, "''");
+  return `inspect '${quote(wtPath)}' manually \u2014 a reparse point resolves outside the worktree; never remove it recursively`;
+}
 async function describePreCleanFailure(wtPath, execGit, error) {
   const dryRun = await execGit(["-C", wtPath, "clean", "-ndX"]).catch(() => "");
   const remaining = dryRun.split(/\r?\n/).map((line) => line.trim()).filter((line) => line.startsWith("Would remove ")).map((line) => line.slice("Would remove ".length));
@@ -37977,6 +38097,25 @@ async function verifyBranchHead(git3, branch, expectedHeadOid) {
   }
   return { ok: true };
 }
+async function switchPrimaryCheckoutOffMergedBranch(wtPath, branch, baseRef, execGit, expectedHeadOid) {
+  const git3 = (args) => execGit(["-C", wtPath, ...args]);
+  const headCheck = await verifyBranchHead(git3, branch, expectedHeadOid);
+  if (!headCheck.ok) return { ok: false, error: headCheck.error ? `${headCheck.reason}: ${headCheck.error}` : headCheck.reason };
+  const porcelain = await git3(["status", "--porcelain"]).catch(() => void 0);
+  if (porcelain === void 0) return { ok: false, error: "could not read the primary checkout status" };
+  if (porcelainHasBlockingChanges(porcelain)) return { ok: false, error: "dirty-worktree" };
+  try {
+    await git3(["switch", baseRef]);
+  } catch (e) {
+    return { ok: false, error: `switch to ${baseRef} failed: ${formatGitCommandError(e)}` };
+  }
+  try {
+    await git3(["branch", "-D", branch]);
+  } catch (e) {
+    return { ok: false, switchedTo: baseRef, error: `branch -D ${branch} failed after switching to ${baseRef}: ${formatGitCommandError(e)}` };
+  }
+  return { ok: true, switchedTo: baseRef };
+}
 async function teardownWorktreeStage(worktreePath) {
   try {
     const result = await stopStage({ cwd: worktreePath, requiredIdentityCwd: worktreePath, globalStatePath: false });
@@ -38070,7 +38209,7 @@ async function removeWorktreeWithReconcile(wtPath, git3, listWorktrees, pathExis
 }
 function isPrMergeWorktreePartial(cleanup) {
   const worktree = cleanup?.worktree;
-  return Boolean(worktree?.path && worktree.status !== "removed" && worktree.status !== "preserved" && worktree.status !== "retained-locked");
+  return Boolean(worktree?.path && worktree.status !== "removed" && worktree.status !== "preserved" && worktree.status !== "retained-locked" && worktree.status !== "switched-primary");
 }
 function prMergeLocalCleanupExitCode(cleanup) {
   return cleanup?.worktree?.status === "failed" || cleanup?.localBranch?.status === "failed" ? 1 : void 0;
@@ -38110,10 +38249,29 @@ async function cleanupPrMergeLocalBranch(branch, options) {
   const mainWorktreeTarget = Boolean(wtPath && mainWorktreePath && samePath(wtPath, mainWorktreePath));
   if (!wtPath || mainWorktreeTarget) {
     if (wtPath && mainWorktreeTarget) {
+      const switched = await switchPrimaryCheckoutOffMergedBranch(wtPath, branch, options.baseRef, execGit, options.expectedHeadOid);
+      if (switched.ok) {
+        report.worktree = { path: wtPath, status: "switched-primary", reason: "main-worktree", switchedTo: switched.switchedTo };
+        report.localBranch = { name: branch, status: "deleted" };
+        return report;
+      }
+      if (switched.switchedTo) {
+        report.worktree = {
+          path: wtPath,
+          status: "switched-primary",
+          reason: "main-worktree",
+          switchedTo: switched.switchedTo,
+          error: switched.error,
+          remediation: primaryCheckoutBranchRemediation(options.primaryRoot, options.baseRef, branch)
+        };
+        report.localBranch = { name: branch, status: "failed", error: switched.error };
+        return report;
+      }
       report.worktree = {
         path: wtPath,
         status: "not-attempted",
         reason: "main-worktree",
+        error: switched.error,
         remediation: primaryCheckoutBranchRemediation(options.primaryRoot, options.baseRef, branch)
       };
     }
@@ -38133,7 +38291,12 @@ async function cleanupPrMergeLocalBranch(branch, options) {
     return report;
   }
   const porcelain = await execGit(["-C", wtPath, "status", "--porcelain"]).catch(() => void 0);
-  if (porcelain?.trim()) {
+  if (porcelain === void 0) {
+    report.worktree = { path: wtPath, status: "refused", reason: "status-unreadable", error: "could not read the worktree status" };
+    report.localBranch = { name: branch, status: "not-attempted", reason: "status-unreadable" };
+    return report;
+  }
+  if (porcelain.trim()) {
     report.worktree = { path: wtPath, status: "refused", reason: "dirty-worktree" };
     report.localBranch = { name: branch, status: "not-attempted", reason: "dirty-worktree" };
     return report;
@@ -38183,6 +38346,25 @@ async function cleanupPrMergeLocalBranch(branch, options) {
     report.localBranch = { name: branch, status: "not-attempted", reason: "archive-failed" };
     return report;
   }
+  const unlinkedReparsePoints = [];
+  const refuseReparseEscape = (error) => {
+    report.worktree = {
+      path: wtPath,
+      status: "refused",
+      reason: "reparse-escape",
+      error,
+      artifactsArchive,
+      stageTeardown,
+      tmpEvidenceCount: tmpEvidence.length,
+      ...unlinkedReparsePoints.length ? { unlinkedReparsePoints } : {},
+      remediation: reparseEscapeRemediation(wtPath)
+    };
+    report.localBranch = { name: branch, status: "not-attempted", reason: "reparse-escape" };
+    return report;
+  };
+  const preHelperGuard = unlinkEscapingReparsePoints(wtPath, options.primaryRoot);
+  if (!preHelperGuard.ok) return refuseReparseEscape(preHelperGuard.error);
+  unlinkedReparsePoints.push(...preHelperGuard.unlinked);
   if (pathExists((0, import_node_path38.join)(wtPath, "node_modules"))) {
     const nmRemoved = await (options.removeRealNodeModules ?? ((p) => removeWorktreeNodeModulesViaHelper(p, { cwd: mainWorktreePath })))(wtPath);
     if (!nmRemoved.ok) {
@@ -38194,6 +38376,7 @@ async function cleanupPrMergeLocalBranch(branch, options) {
         artifactsArchive,
         stageTeardown,
         tmpEvidenceCount: tmpEvidence.length,
+        ...unlinkedReparsePoints.length ? { unlinkedReparsePoints } : {},
         remediation: `jervcode worktree-node-modules-cleanup --worktree '${wtPath.replace(/'/g, "''")}'`
       };
       report.localBranch = { name: branch, status: "not-attempted", reason: "worktree-pre-clean-failed" };
@@ -38210,12 +38393,16 @@ async function cleanupPrMergeLocalBranch(branch, options) {
       artifactsArchive,
       stageTeardown,
       tmpEvidenceCount: tmpEvidence.length,
+      ...unlinkedReparsePoints.length ? { unlinkedReparsePoints } : {},
       // #6076: name the surviving node_modules remover when the dry run found one, else the clean.
       remediation: preClean.remediation ?? `git -C '${wtPath.replace(/'/g, "''")}' clean -ffdX`
     };
     report.localBranch = { name: branch, status: "not-attempted", reason: "worktree-pre-clean-failed" };
     return report;
   }
+  const preRemoveGuard = unlinkEscapingReparsePoints(wtPath, options.primaryRoot);
+  if (!preRemoveGuard.ok) return refuseReparseEscape(preRemoveGuard.error);
+  unlinkedReparsePoints.push(...preRemoveGuard.unlinked);
   moveCwdToSafeWorktree(wtPath, safeCwd);
   const removal = await removeWorktreeWithReconcile(
     wtPath,
@@ -38230,7 +38417,8 @@ async function cleanupPrMergeLocalBranch(branch, options) {
       error: removal.error,
       artifactsArchive,
       stageTeardown,
-      tmpEvidenceCount: tmpEvidence.length
+      tmpEvidenceCount: tmpEvidence.length,
+      ...unlinkedReparsePoints.length ? { unlinkedReparsePoints } : {}
     };
     report.localBranch = { name: branch, status: "not-attempted", reason: "worktree-removal-failed" };
     return report;
@@ -38241,7 +38429,8 @@ async function cleanupPrMergeLocalBranch(branch, options) {
     ...removal.reason ? { reason: removal.reason } : {},
     artifactsArchive,
     stageTeardown,
-    tmpEvidenceCount: tmpEvidence.length
+    tmpEvidenceCount: tmpEvidence.length,
+    ...unlinkedReparsePoints.length ? { unlinkedReparsePoints } : {}
   };
   if (pathExists(wtPath)) {
     const residue = await (options.removeResidueDir?.(wtPath) ?? removeResidueDirectory(wtPath));
@@ -38253,7 +38442,7 @@ async function cleanupPrMergeLocalBranch(branch, options) {
       if (isWindowsCwdLockResidueError(residue.error) && isPathAtOrWithin(options.startingPath, wtPath)) {
         report.worktree.status = "retained-locked";
         report.worktree.reason = "parent-cwd-lock";
-        report.worktree.remediation = deferredCwdLockRemediation(options.primaryRoot, wtPath);
+        report.worktree.remediation = deferredCwdLockRemediation(wtPath);
       } else {
         report.worktree.status = "failed";
         report.worktree.reason = "residue-remains";
@@ -38289,12 +38478,18 @@ function renderPrMergeCleanupLines(cleanup) {
     lines2.push(`pr merge: preserved worktree ${wt.path} (--preserve-worktree)`);
   } else if (wt.status === "retained-locked") {
     lines2.push(`pr merge: worktree ${wt.path} cleanup deferred \u2014 its Windows parent shell still holds the cwd; ${wt.remediation ?? "exit the shell and remove the residue from the primary checkout"}`);
+  } else if (wt.status === "switched-primary") {
+    const now = wt.switchedTo ? `to ${wt.switchedTo}` : "to the base branch";
+    lines2.push(wt.error ? `pr merge: primary checkout ${wt.path} switched ${now} but deleting the merged branch failed \u2014 ${wt.error}; remediate: ${wt.remediation ?? "delete the merged branch manually"}` : `pr merge: primary checkout ${wt.path} held the merged branch \u2014 switched it back ${now} and deleted the branch`);
   } else if (wt.status === "not-attempted" && wt.reason === "main-worktree") {
-    lines2.push(`pr merge: merged branch is still checked out in the primary checkout ${wt.path} \u2014 not removed; remediate: ${wt.remediation ?? "switch it back to the base branch and delete the merged branch"}`);
+    lines2.push(`pr merge: merged branch is still checked out in the primary checkout ${wt.path} \u2014 not removed${wt.error ? ` (${wt.error})` : ""}; remediate: ${wt.remediation ?? "switch it back to the base branch and delete the merged branch"}`);
   }
   if (wt.residue === "left" && wt.status !== "retained-locked") {
     lines2.push(`pr merge: worktree ${wt.path} registration is gone but residue remains \u2014 ${wt.residueError ?? wt.path}; remediate: ${wt.remediation ?? wt.path}`);
   }
+  if (wt.unlinkedReparsePoints?.length) {
+    lines2.push(`pr merge: unlinked ${wt.unlinkedReparsePoints.length} reparse point(s) resolving outside ${wt.path}: ${wt.unlinkedReparsePoints.join(", ")}`);
+  }
   if (wt.artifactsArchive?.status === "archived" && wt.artifactsArchive.path) {
     lines2.push(`pr merge: archived worktree evidence to ${wt.artifactsArchive.path}`);
   } else if (wt.artifactsArchive?.status === "blocked" && wt.artifactsArchive.error) {
@@ -39356,7 +39551,7 @@ ${list}`);
     else printLine(`pr land: ${result.status}${result.error ? ` \u2014 ${result.error}` : ""}`);
     if (result.status === "failed") process.exitCode = 1;
   });
-  jsonParity(pr.command("merge <number>").description("merge a PR (squash by default); archives gitignored tmp/** before worktree teardown; on no-ci repos run pr ci-policy / checks-wait first (#1432, #5679)").option("--squash", "squash merge (default)").option("--merge", "create a merge commit").option("--rebase", "rebase merge").option("--repo <owner/repo>", "target repo (defaults to the current repo)").option("--auto", "enable auto-merge \u2014 merge once the base-branch policy is satisfied (use for policy-gated repos)").addOption(new Option("--disable-auto", "disable a queued auto-merge without merging").conflicts(["auto", "wait", "squash", "merge", "rebase", "preserveWorktree", "gc", "squashBodyFile", "force"])).option("--wait", `wait for checks to reach a terminal passing verdict before merging (default budget ${PR_CHECKS_TIMEOUT_MS / 6e4}m) \u2014 run as a background/monitor task or under a shell timeout above that budget; a short foreground timeout (e.g. 120s) kills it after checks pass and leaves the PR open (#6027)`).option("--preserve-worktree", "after merge, keep the local PR worktree/branch for an active batch (#1888)").option("--gc", "acknowledge deleting unarchived gitignored tmp/** evidence newer than the branch base (#5679)").option("--squash-body-file <path>", "squash commit body (overrides GitHub COMMIT_MESSAGES); use when a pushed commit mentions close/fix/resolve + #N that must not close (#5723)").option("--force", "acknowledge and merge past a remaining prunable/severe scratch housekeeping block (advisory kept plans/ never blocks, #3012) or a negated-closing-keyword (#3718) or ambiguous-cross-repo-closing (#4279) refusal")).action(async (number, o) => {
+  jsonParity(pr.command("merge <number>").description("merge a PR (squash by default); archives gitignored tmp/** before worktree teardown; on no-ci repos run pr ci-policy / checks-wait first (#1432, #5679)").option("--squash", "squash merge (default)").option("--merge", "create a merge commit").option("--rebase", "rebase merge").option("--repo <owner/repo>", "target repo (defaults to the current repo); from a foreign checkout the remote probe/delete address this repo and local cleanup runs only in the verified sibling checkout ../<repo>, else localBranch reports skipped-foreign-cwd and the receipt carries foreignCwd: true (#6148)").option("--auto", "enable auto-merge \u2014 merge once the base-branch policy is satisfied (use for policy-gated repos)").addOption(new Option("--disable-auto", "disable a queued auto-merge without merging").conflicts(["auto", "wait", "squash", "merge", "rebase", "preserveWorktree", "gc", "squashBodyFile", "force"])).option("--wait", `wait for checks to reach a terminal passing verdict before merging (default budget ${PR_CHECKS_TIMEOUT_MS / 6e4}m) \u2014 run as a background/monitor task or under a shell timeout above that budget; a short foreground timeout (e.g. 120s) kills it after checks pass and leaves the PR open (#6027)`).option("--preserve-worktree", "after merge, keep the local PR worktree/branch for an active batch (#1888)").option("--gc", "acknowledge deleting unarchived gitignored tmp/** evidence newer than the branch base (#5679)").option("--squash-body-file <path>", "squash commit body (overrides GitHub COMMIT_MESSAGES); use when a pushed commit mentions close/fix/resolve + #N that must not close (#5723)").option("--force", "acknowledge and merge past a remaining prunable/severe scratch housekeeping block (advisory kept plans/ never blocks, #3012) or a negated-closing-keyword (#3718) or ambiguous-cross-repo-closing (#4279) refusal")).action(async (number, o) => {
     const method = o.rebase ? "--rebase" : o.merge ? "--merge" : "--squash";
     const repoArgs = o.repo ? ["--repo", o.repo] : [];
     if (o.disableAuto) {
@@ -39416,7 +39611,23 @@ ${list}`);
     const startingPath = (await execFileP("git", ["rev-parse", "--show-toplevel"], { timeout: GIT_TIMEOUT_MS }).catch(() => ({ stdout: "" }))).stdout.trim();
     const housekeeping = assertPrMergeHousekeepingClean(startingPath || process.cwd(), "pr merge", { force: o.force });
     const beforeWorktreesRead = await execFileP("git", ["worktree", "list", "--porcelain"], { timeout: GIT_TIMEOUT_MS }).then((r) => ({ state: "ok", stdout: r.stdout })).catch((e) => ({ state: "failed", error: e.message || "git worktree list failed" }));
-    const beforeWorktrees = beforeWorktreesRead.state === "ok" ? parseGitWorktreePorcelain(beforeWorktreesRead.stdout) : [];
+    let beforeWorktrees = beforeWorktreesRead.state === "ok" ? parseGitWorktreePorcelain(beforeWorktreesRead.stdout) : [];
+    const cwdRepo = repoFromRemoteUrl(await gitOut(["remote", "get-url", "origin"]).catch(() => ""));
+    const targetRepo2 = repoForPostCleanup ? repoForPostCleanup.split("/").slice(-2).join("/") : void 0;
+    const foreignCwd = Boolean(o.repo) && Boolean(targetRepo2) && cwdRepo?.toLowerCase() !== targetRepo2.toLowerCase();
+    const remote = foreignCwd ? `https://github.com/${targetRepo2}.git` : "origin";
+    let foreignCheckout;
+    if (foreignCwd) {
+      const sibling = (0, import_node_path39.join)((0, import_node_path39.dirname)(beforeWorktrees[0]?.path || startingPath || process.cwd()), targetRepo2.split("/")[1]);
+      const siblingRepo = repoFromRemoteUrl(await gitOut(["-C", sibling, "remote", "get-url", "origin"]).catch(() => ""));
+      if (siblingRepo?.toLowerCase() === targetRepo2.toLowerCase()) {
+        const siblingWorktrees = await execFileP("git", ["-C", sibling, "worktree", "list", "--porcelain"], { timeout: GIT_TIMEOUT_MS }).then((r) => parseGitWorktreePorcelain(r.stdout)).catch(() => void 0);
+        if (siblingWorktrees?.length) {
+          foreignCheckout = sibling;
+          beforeWorktrees = siblingWorktrees;
+        }
+      }
+    }
     const ciHeadRef = repoForPostCleanup ? await prHeadRefForCiProbe(number, repoForPostCleanup) : void 0;
     const ciPolicy = await resolveMergeCiPolicyForCheckout(o.repo, ciHeadRef);
     if (o.wait) {
@@ -39474,7 +39685,7 @@ ${list}`);
       if (guard.action === "refuse") throw new Error(`gh pr merge ${number}: ${guard.message}`);
       if (guard.note) console.warn(`pr merge: ${guard.note}`);
     }
-    const remoteBefore = await remoteBranchExists2(headRef);
+    const remoteBefore = await remoteBranchExists2(headRef, { remote });
     let upgradedToAuto = false;
     let remoteNotAttemptedReason = "preserved-delayed-cleanup";
     const overrideBody = mergeSquashBody ? { ...writeSquashBodyFile(mergeSquashBody), text: mergeSquashBody } : await composeOverrideBodyFile(
@@ -39593,30 +39804,34 @@ ${list}`);
     }
     const primaryRoot = beforeWorktrees[0]?.path ?? (startingPath || process.cwd());
     let localCleanup;
-    try {
-      localCleanup = await cleanupPrMergeLocalBranch(headRef, {
-        beforeWorktrees,
-        startingPath,
-        baseRef,
-        primaryRoot,
-        preserveWorktree: o.preserveWorktree,
-        gcAcknowledged: o.gc,
-        expectedHeadOid: headRefOid,
-        pathExists: (p) => (0, import_node_fs42.existsSync)(p),
-        // #5899: pin cleanup git calls to the main checkout — the task worktree this process may be
-        // standing in is removed mid-cleanup, so a cwd-relative invocation fails with
-        // 'fatal: not a git repository' and leaves a spurious partial-cleanup exit.
-        execGit: async (args) => (await execFileP("git", cleanupGitArgs(primaryRoot, args), { timeout: GIT_TIMEOUT_MS })).stdout
-      });
-    } catch (e) {
-      localCleanup = {
-        branch: headRef,
-        localBranch: {
-          name: headRef,
-          status: "failed",
-          error: e instanceof Error ? e.message : String(e)
-        }
-      };
+    if (foreignCwd && !foreignCheckout) {
+      localCleanup = { branch: headRef, localBranch: { name: headRef, status: "not-attempted", reason: "skipped-foreign-cwd" } };
+    } else {
+      try {
+        localCleanup = await cleanupPrMergeLocalBranch(headRef, {
+          beforeWorktrees,
+          startingPath,
+          baseRef,
+          primaryRoot,
+          preserveWorktree: o.preserveWorktree,
+          gcAcknowledged: o.gc,
+          expectedHeadOid: headRefOid,
+          pathExists: (p) => (0, import_node_fs42.existsSync)(p),
+          // #5899: pin cleanup git calls to the main checkout — the task worktree this process may be
+          // standing in is removed mid-cleanup, so a cwd-relative invocation fails with
+          // 'fatal: not a git repository' and leaves a spurious partial-cleanup exit.
+          execGit: async (args) => (await execFileP("git", cleanupGitArgs(primaryRoot, args), { timeout: GIT_TIMEOUT_MS })).stdout
+        });
+      } catch (e) {
+        localCleanup = {
+          branch: headRef,
+          localBranch: {
+            name: headRef,
+            status: "failed",
+            error: e instanceof Error ? e.message : String(e)
+          }
+        };
+      }
     }
     const remoteBranch = await deleteMergedRemoteBranch({
       branch: headRef,
@@ -39627,7 +39842,9 @@ ${list}`);
       // #5899: this leg runs after worktree teardown — anchor it to the main checkout so a cwd inside
       // the removed worktree cannot turn the delete into 'fatal: not a git repository' + manual remediation.
       execGit: async (args) => (await execFileP("git", cleanupGitArgs(primaryRoot, args), { timeout: GIT_TIMEOUT_MS })).stdout,
-      branchExists: (b) => remoteBranchExists2(b, { cwd: primaryRoot })
+      branchExists: (b) => remoteBranchExists2(b, { cwd: primaryRoot, remote }),
+      // #6148: aim the delete and its proof at `--repo`, not the cwd checkout's origin.
+      remote
     });
     const worktree = localCleanup?.worktree;
     const worktreePartial = isPrMergeWorktreePartial(localCleanup) && worktree?.path ? {
@@ -39690,6 +39907,7 @@ ${list}`);
       ...methodField ? { method: methodField } : {},
       remoteBranch,
       housekeeping,
+      ...foreignCwd ? { foreignCwd: true, ...foreignCheckout ? { foreignCheckout } : {} } : {},
       ...partialCleanup.length ? { cleanupStatus: "partial", partialCleanup } : {},
       ...localCleanup?.worktree ? { worktree: localCleanup.worktree } : {},
       ...localCleanup?.localBranch ? { localBranch: localCleanup.localBranch } : {},
@@ -40599,8 +40817,12 @@ function registerDeveloperCommands(program3) {
   registerSchedulesCommands(program3);
   registerSchedulesLiftCommand(program3);
   const docs = program3.command("docs").description("generated docs surfaces \u2014 the routing index (org knowledge layer)");
-  docs.command("index").description("regenerate docs/index.md from the docs/ tree (--write, the default) or fail on drift (--check) \u2014 the generated routing index, never hand-maintained").option("--check", "compare against the committed docs/index.md and exit 1 on drift; never write").option("--write", "regenerate docs/index.md when it has drifted (the default)").action(async (o) => {
+  docs.command("index").description("regenerate docs/index.md from the docs/ tree (--write, the default) or fail on drift (--check) \u2014 the generated routing index, never hand-maintained").option("--check", "compare against the committed docs/index.md and exit 1 on drift; never write").option("--write", "regenerate docs/index.md when it has drifted (the default)").addOption(new Option("--repo <owner/repo>", "not accepted \u2014 docs index reads the current checkout").hideHelp()).action(async (o) => {
     try {
+      if (o.repo) {
+        const guard = planTrainApplyRepoGuard(o.repo, await resolveRepo(), `mmi-cli oracle docs index ${o.check ? "--check" : "--write"}`, "docs index");
+        if (!guard.ok) return failGraceful(guard.message);
+      }
       const root = await repoRoot();
       const result = docsIndex(createDocsIndexDeps(root), { check: Boolean(o.check) });
       if (o.check) {
@@ -40615,8 +40837,12 @@ function registerDeveloperCommands(program3) {
       await failGraceful(e.message);
     }
   });
-  docs.command("refs").description("deterministic doc reference gate: every backticked repo path, relative .md link, `mmi-cli` command ref, and `<!-- pinned by \u2014 -->` comment across docs/** + README.md + architecture.md must resolve, or exit 1 (fleet-portable port of the Hub gate scripts/check-doc-refs.mjs, #3339)").option("--json", "machine-readable findings list: { ok, docCount, findings[], warnings[] }").action(async (o) => {
+  docs.command("refs").description("deterministic doc reference gate: every backticked repo path, relative .md link, `mmi-cli` command ref, and `<!-- pinned by \u2014 -->` comment across docs/** + README.md + architecture.md must resolve, or exit 1 (#3339)").option("--json", "machine-readable findings list: { ok, docCount, findings[], warnings[] }").addOption(new Option("--repo <owner/repo>", "not accepted \u2014 docs refs reads the current checkout").hideHelp()).action(async (o) => {
     try {
+      if (o.repo) {
+        const guard = planTrainApplyRepoGuard(o.repo, await resolveRepo(), `mmi-cli oracle docs refs${o.json ? " --json" : ""}`, "docs refs");
+        if (!guard.ok) return failGraceful(guard.message);
+      }
       const root = await repoRoot();
       const commandPaths = new Set(
         buildCommandManifest(program3).index.map((entry) => entry.path)
@@ -40642,8 +40868,12 @@ function registerDeveloperCommands(program3) {
     }
   });
   const spawnCmd = program3.command("spawn").description("this repo's process-spawn contract \u2014 every child process must be unable to pop a console window");
-  spawnCmd.command("policy").description("enforce the windowsHide contract across this repo's tracked source: a child_process call must set windowsHide, or take its options from a named constant, a type annotation, or a forwarded caller bag that does. Waive a call the scan cannot classify with a `// windows-hide-exempt: <reason>` comment on the line above it (#3979)").option("--json", "machine-readable result: { ok, scannedCount, findings[] }").action(async (o) => {
+  spawnCmd.command("policy").description("enforce the windowsHide contract across this repo's tracked source: a child_process call must set windowsHide, or take its options from a named constant, a type annotation, or a forwarded caller bag that does. Waive a call the scan cannot classify with a `// windows-hide-exempt: <reason>` comment on the line above it (#3979)").option("--json", "machine-readable result: { ok, scannedCount, findings[] }").addOption(new Option("--repo <owner/repo>", "not accepted \u2014 spawn policy reads the current checkout").hideHelp()).action(async (o) => {
     try {
+      if (o.repo) {
+        const guard = planTrainApplyRepoGuard(o.repo, await resolveRepo(), `mmi-cli spawn policy${o.json ? " --json" : ""}`, "spawn policy");
+        if (!guard.ok) return failGraceful(guard.message);
+      }
       const root = await repoRoot();
       const result = runSpawnPolicy(root);
       if (o.json) {
@@ -40665,8 +40895,13 @@ function registerDeveloperCommands(program3) {
     }
   });
   const tests = program3.command("tests").description("a repo's test-policy.json \u2014 the opt-in test contract and its enforcement");
-  tests.command("policy").description("enforce this repo's test-policy.json against the diff: a mandatory-zone change must carry a test, an unrequested new test file is refused, a `protected` test file may not be deleted or renamed away, and a `protected` entry naming a missing file is refused. Override any of them with a `Test-Policy-Override: <reason>` commit trailer (#3605)").option("--json", "machine-readable result: { ok, base, policySource: { ref, sha, path }, root, changedCount, mandatoryCount, matchedMandatoryCount, matchedMandatoryGlobs, testCommandsAllowed, commandClasses, findings[] }").option("--base <ref>", "comparison base (default: TEST_POLICY_BASE, then origin/development, then origin/main)").option("--policy-ref <commit>", "load only test-policy.json from the exact fetched origin/development commit; valid only with --base origin/main").action(async (o) => {
+  tests.command("policy").description("enforce this repo's test-policy.json against the diff: a mandatory-zone change must carry a test, an unrequested new test file is refused, a `protected` test file may not be deleted or renamed away, and a `protected` entry naming a missing file is refused. Override any of them with a `Test-Policy-Override: <reason>` commit trailer (#3605)").option("--json", "machine-readable result: { ok, base, policySource: { ref, sha, path }, root, changedCount, mandatoryCount, matchedMandatoryCount, matchedMandatoryGlobs, testCommandsAllowed, commandClasses, findings[] }").option("--base <ref>", "comparison base (default: TEST_POLICY_BASE, then origin/development, then origin/main)").option("--policy-ref <commit>", "load test-policy.json from the exact fetched origin/development commit and audit its protected/satisfiedBy paths against that commit's tree, not this checkout; valid only with --base origin/main").addOption(new Option("--repo <owner/repo>", "not accepted \u2014 tests policy reads the current checkout").hideHelp()).action(async (o) => {
     try {
+      if (o.repo) {
+        const rerun = `mmi-cli tests policy${o.base ? ` --base ${o.base}` : ""}${o.policyRef ? ` --policy-ref ${o.policyRef}` : ""}${o.json ? " --json" : ""}`;
+        const guard = planTrainApplyRepoGuard(o.repo, await resolveRepo(), rerun, "tests policy");
+        if (!guard.ok) return failGraceful(guard.message);
+      }
       const root = await repoRoot();
       const result = runTestPolicy(root, { base: o.base, policyRef: o.policyRef });
       if (o.json) {
@@ -40696,8 +40931,12 @@ function registerDeveloperCommands(program3) {
     }
   });
   const distCmd = program3.command("dist").description("this repo's committed dist/BOM drift receipt \u2014 whether cli/dist, updater/dist and distribution-bom.json still match a fresh build of source");
-  distCmd.command("status").description("rebuild every committed dist artifact to a temp dir and report committed vs rebuilt-expected sha256 plus the BOM's recorded dist identities \u2014 a visible, non-blocking receipt. Development checkouts may lag source until the release fold; drift NEVER fails the run, and nothing is refreshed for you (#5576)").option("--json", "machine-readable receipt: { ok, staleCount, artifacts[], bom, summary } (full hashes; drift still exits 0)").action(async (o) => {
+  distCmd.command("status").description("rebuild every committed dist artifact to a temp dir and report committed vs rebuilt-expected sha256 plus the BOM's recorded dist identities \u2014 a visible, non-blocking receipt. Development checkouts may lag source until the release fold; drift NEVER fails the run, and nothing is refreshed for you (#5576)").option("--json", "machine-readable receipt: { ok, staleCount, artifacts[], bom, summary } (full hashes; drift still exits 0)").addOption(new Option("--repo <owner/repo>", "not accepted \u2014 dist status reads the current checkout").hideHelp()).action(async (o) => {
     try {
+      if (o.repo) {
+        const guard = planTrainApplyRepoGuard(o.repo, await resolveRepo(), `mmi-cli dist status${o.json ? " --json" : ""}`, "dist status");
+        if (!guard.ok) return failGraceful(guard.message);
+      }
       const root = await repoRoot();
       const receipt = runDistStatus(root);
       if (o.json) {
@@ -40992,7 +41231,7 @@ async function resolveHotfixDeployModel(deps, ctx) {
 }
 async function hotfixPreflight(deps, ctx, verb, targetTag) {
   const meta = requireProjectMetaForTrain(await loadProjectMeta(deps, ctx), ctx.repo);
-  const deployModel = await preflight(deps, ctx, "main", meta);
+  const deployModel = await preflight(deps, ctx, "main", meta, "hotfix");
   const root = await hotfixCheckoutRoot(deps);
   const begin = await beginReleaseLedger(deps, root, targetTag);
   if (!begin.ok) throw new Error(`hotfix ${verb} refused before any mutation: ${begin.error}`);
@@ -41351,6 +41590,16 @@ function hotfixDispatchFromRuns(runs, note) {
   const tenantDeploy2 = runs.find((r) => r.workflow === "tenant-deploy.yml");
   return { note, deployStatus, workflowRuns, ...tenantDeploy2?.runId != null ? { runId: tenantDeploy2.runId } : {}, ...tenantDeploy2?.url ? { runUrl: tenantDeploy2.url } : {} };
 }
+async function appendHotfixGatewayRun(deps, repo, tag, sha, runs, note) {
+  const input = hotfixDispatchFromRuns(runs, note);
+  const gateway = await appendJervGatewayReleaseDeploy(deps, repo, tag, sha, input);
+  if (gateway === input) return note;
+  const row = gateway.workflowRuns?.at(-1);
+  if (row?.workflow === "jerv-gateway") {
+    runs.push({ workflow: row.workflow, ...row.runUrlNote ? { runUrlNote: row.runUrlNote } : {}, conclusion: row.conclusion });
+  }
+  return gateway.note;
+}
 function hotfixPhaseInputsFromRuns(deployModel, runs, note, publishDispatch, publishRequired, opts) {
   const dispatch = hotfixDispatchFromRuns(runs, note);
   return {
@@ -41594,6 +41843,7 @@ ${decision.note}`);
   } else {
     deployNote = `no hotfix deploy dispatch for deployModel=${deployModel} \u2014 prod deploy is repo-specific`;
   }
+  deployNote = await appendHotfixGatewayRun(deps, ctx.repo, tag, mergedSha, runs, deployNote);
   const ledgerInputs = hotfixPhaseInputsFromRuns(
     deployModel,
     runs,
@@ -41786,6 +42036,9 @@ function hotfixStatusRunsFromLedger(ledger) {
       workflow: record.workflow ?? phase,
       ...record.runId != null ? { runId: record.runId } : {},
       ...record.runUrl ? { url: record.runUrl } : {},
+      // #912: the operator-host Gateway leg carries no run id by design — without its own note the
+      // renderer's missing-URL fallback reads it as 'run absent or unreadable'.
+      ...record.workflow === "jerv-gateway" ? { runUrlNote: JERV_GATEWAY_RUN_URL_NOTE } : {},
       conclusion: record.state === "complete" ? "success" : record.state === "failed" ? "failure" : "pending"
     }];
   });
@@ -42243,8 +42496,8 @@ function trainApplyDeps() {
   };
 }
 function formatWorkflowRun(r) {
-  const ref = r.runUrl ?? (r.runId != null ? String(r.runId) : "unresolved");
-  return `${r.workflow} ${ref} ${r.conclusion.toUpperCase()}`;
+  const evidenced = workflowRunWithEvidence(r);
+  return `${evidenced.workflow} ${evidenced.runUrl ?? evidenced.runUrlNote} ${evidenced.conclusion.toUpperCase()}`;
 }
 function renderDeployLine(d) {
   const parts = [d.dispatch];
@@ -42266,6 +42519,7 @@ function renderReleaseResume(r) {
   if (r.devRollForward) lines2.push(`  development: ${r.devRollForward.note}`);
   if (r.rcAlignment) lines2.push(`  rc: ${r.rcAlignment.note}`);
   if (r.checkout) lines2.push(`  checkout: ${r.checkout.note}`);
+  if (r.projectInfoSync) lines2.push(`  project info: ${r.projectInfoSync.note}`);
   if (r.ledger) lines2.push(...formatReleaseLedgerReport(r.ledger).map((l, i) => i === 0 ? `  ${l}` : `  ${l}`));
   return lines2.join("\n");
 }
@@ -42293,7 +42547,8 @@ function releaseFollowUpLegs(result, projectInfoSync) {
   const legs = [
     {
       leg: "project-info",
-      status: projectInfoSync && "error" in projectInfoSync ? "failed" : "success",
+      // #6180: a transient Hub read outage is PENDING (rerun the manual verb), never a failed follow-up.
+      status: projectInfoSync && "error" in projectInfoSync ? projectInfoSync.pending ? "pending" : "failed" : "success",
       ...projectInfoSync && "error" in projectInfoSync ? { error: projectInfoSync.error } : {}
     }
   ];
@@ -42332,6 +42587,24 @@ function releaseFollowUpLegs(result, projectInfoSync) {
   }
   return legs;
 }
+function hotfixFollowUpLegs(runs, foldPort, alignment, foldNote, deployNote) {
+  const legs = runs.map((run) => ({
+    leg: run.workflow,
+    status: followUpLegStatus(run.conclusion === "failure" ? "failure" : run.conclusion === "success" ? "success" : "pending"),
+    // #912 lane parity with releaseFollowUpLegs: the operator-host Gateway leg has no workflow run to
+    // read, so its deploy note IS the error — a flat "workflow reported failure" names nothing.
+    ...run.conclusion === "failure" ? { error: run.workflow === "jerv-gateway" && deployNote ? deployNote : "workflow reported failure" } : {}
+  }));
+  if (foldPort === "failure") {
+    legs.push({ leg: "development-fold-port", status: "failed", error: foldNote ?? "development fold port failed" });
+  }
+  if (alignment === "unresolved") {
+    legs.push({ leg: "development-fold-alignment", status: "pending" });
+  } else if (alignment === "failure" && foldPort !== "failure") {
+    legs.push({ leg: "development-fold-alignment", status: "failed", error: foldNote ?? "development fold alignment failed" });
+  }
+  return legs;
+}
 var JERV_POWERTOOLS_REPO = "mutmutco/Jerv-PowerTools";
 async function runPostReleaseJervDoctor(repo) {
   if (repo.toLowerCase() !== JERV_POWERTOOLS_REPO.toLowerCase()) return void 0;
@@ -42347,10 +42620,35 @@ async function runPostReleaseJervDoctor(repo) {
     };
   }
 }
+async function runProjectInfoSyncLeg(cb, repo, sleep2 = (ms) => new Promise((resolve7) => setTimeout(resolve7, ms))) {
+  for (let attempt = 0; ; attempt++) {
+    try {
+      return await cb(repo, true);
+    } catch (e) {
+      const error = e.message;
+      if (!(e instanceof ProjectInfoReadUnavailableError)) return { applied: false, note: `FAILED \u2014 ${error}`, error };
+      if (attempt === 0) {
+        await sleep2(PROJECT_INFO_RETRY_MS);
+        continue;
+      }
+      return {
+        applied: false,
+        pending: true,
+        note: `PENDING \u2014 ${error}; rerun \`mmi-cli oracle org project sync-info ${repo} --apply\``,
+        error
+      };
+    }
+  }
+}
+var PROJECT_INFO_RETRY_MS = 3e3;
+function projectInfoOutcome(projectInfoSync) {
+  if (!projectInfoSync || !("error" in projectInfoSync)) return "ok";
+  return projectInfoSync.pending ? "unresolved" : "failure";
+}
 function buildReleaseVerdict(commandName, result, projectInfoSync) {
   const alignmentPending = result.devRollForward?.status === "pr-pending" || result.rcAlignment?.status === "pr-pending";
   const followUpStatus = deriveTrainFollowUpStatus({
-    projectInfo: projectInfoSync && "error" in projectInfoSync ? "failure" : "ok",
+    projectInfo: projectInfoOutcome(projectInfoSync),
     deploy: deployFollowUpOutcome(result.deployStatus),
     rcRetirement: result.rcRetirement === "failed" ? result.rcRetirementCategory === "wait-timeout" ? "unresolved" : "failure" : "ok",
     alignment: alignmentPending ? "unresolved" : "ok",
@@ -42517,7 +42815,8 @@ function registerTrainOperationsCommands(program3, runProjectInfoSyncCallback) {
         if (o.apply) return fail(`${commandName}: --resume and --apply are mutually exclusive \u2014 --apply cuts the NEXT version, --resume finishes the immutable tag already on origin`);
         try {
           if (commandName === "rcand") {
-            const result2 = await runRcandResume(trainApplyDeps(), { watch: o.watch });
+            const raw2 = await runRcandResume(trainApplyDeps(), { watch: o.watch });
+            const result2 = raw2.workflowRuns ? { ...raw2, workflowRuns: raw2.workflowRuns.map(workflowRunWithEvidence) } : raw2;
             emitTrainResult("rcand --resume", o.json ? JSON.stringify(result2, null, 2) : renderRcandResume(result2), o.out);
             applyTrainFollowUpExit(deriveTrainFollowUpStatus({
               projectInfo: "ok",
@@ -42528,9 +42827,19 @@ function registerTrainOperationsCommands(program3, runProjectInfoSyncCallback) {
             }));
             return;
           }
-          const result = await runReleaseResume(trainApplyDeps(), { watch: o.watch, announceSummaryFile: o.announceSummaryFile });
-          emitTrainResult("release --resume", o.json ? JSON.stringify(result, null, 2) : renderReleaseResume(result), o.out);
-          applyTrainFollowUpExit(resumeFollowUpOf(result.state));
+          const raw = await runReleaseResume(trainApplyDeps(), { watch: o.watch, announceSummaryFile: o.announceSummaryFile });
+          const result = raw.dispatch?.workflowRuns ? { ...raw, dispatch: { ...raw.dispatch, workflowRuns: raw.dispatch.workflowRuns.map(workflowRunWithEvidence) } } : raw;
+          const projectInfoSync = await runProjectInfoSyncLeg(runProjectInfoSyncCallback, result.repo);
+          const resumed = { ...result, projectInfoSync };
+          emitTrainResult("release --resume", o.json ? JSON.stringify(resumed, null, 2) : renderReleaseResume(resumed), o.out);
+          const resumeStatus = resumeFollowUpOf(result.state);
+          applyTrainFollowUpExit(deriveTrainFollowUpStatus({
+            projectInfo: projectInfoOutcome(projectInfoSync),
+            deploy: "ok",
+            rcRetirement: "ok",
+            alignment: resumeStatus === "failed" ? "failure" : resumeStatus === "pending" ? "unresolved" : "ok",
+            foldPort: "ok"
+          }));
           return;
         } catch (e) {
           applyTrainFollowUpExit("failed");
@@ -42563,16 +42872,12 @@ function registerTrainOperationsCommands(program3, runProjectInfoSyncCallback) {
       if (o.apply) {
         try {
           const ack = (o.ack ?? "").split(",").map((s) => s.trim()).filter(Boolean);
-          const result = await runTrainApply(commandName, trainApplyDeps(), { watch: o.watch, announceSummaryFile: o.announceSummaryFile, ack, dev: o.dev });
+          const raw = await runTrainApply(commandName, trainApplyDeps(), { watch: o.watch, announceSummaryFile: o.announceSummaryFile, ack, dev: o.dev });
+          const result = raw.workflowRuns ? { ...raw, workflowRuns: raw.workflowRuns.map(workflowRunWithEvidence) } : raw;
           let projectInfoSync;
           const postReleaseJervDoctor = commandName === "release" ? await runPostReleaseJervDoctor(result.repo) : void 0;
           if (commandName === "release") {
-            try {
-              projectInfoSync = await runProjectInfoSyncCallback(result.repo, true);
-            } catch (e) {
-              const error = e.message;
-              projectInfoSync = { applied: false, note: `FAILED \u2014 ${error}`, error };
-            }
+            projectInfoSync = await runProjectInfoSyncLeg(runProjectInfoSyncCallback, result.repo);
           }
           const { followUpStatus, releaseVerdict } = buildReleaseVerdict(commandName, result, projectInfoSync);
           const reported = {
@@ -42625,6 +42930,13 @@ function registerTrainOperationsCommands(program3, runProjectInfoSyncCallback) {
   function renderHotfixStart(r) {
     return [`mmi-cli devops hotfix start: ${r.tag} (${r.branch}, from ${r.source})${r.reused ? " [reused]" : ""}`, ...r.notes.map((n) => `  - ${n}`)].join("\n");
   }
+  function hotfixRunWithEvidence(run) {
+    return run.url || run.runUrlNote ? run : { ...run, runUrlNote: missingRunUrlNote(run.runId) };
+  }
+  function formatHotfixRun(run) {
+    const evidenced = hotfixRunWithEvidence(run);
+    return `  - ${evidenced.workflow}: ${evidenced.conclusion}${evidenced.conclusion === "failure" ? " \u2014 error: workflow reported failure" : ""} (${evidenced.url ?? evidenced.runUrlNote})`;
+  }
   function renderHotfixRelease(r) {
     return [
       `mmi-cli devops hotfix release: ${r.tag} at ${r.mergedSha.slice(0, 7)} on ${r.repo} (deployModel=${r.deployModel})`,
@@ -42632,7 +42944,7 @@ function registerTrainOperationsCommands(program3, runProjectInfoSyncCallback) {
       `  - ${r.tagNote}`,
       `  - ${r.releaseNote}`,
       `  - deploy: ${r.deployNote}`,
-      ...r.runs.map((run) => `  - ${run.workflow}: ${run.conclusion}${run.conclusion === "failure" ? " \u2014 error: workflow reported failure" : ""}${run.url ? ` (${run.url})` : ""}`),
+      ...r.runs.map(formatHotfixRun),
       `  - ${r.verifyNote}`,
       ...r.announceNote ? [`  - announce: ${r.announceNote}`] : [],
       `  - fold: ${r.foldNote}`,
@@ -42649,7 +42961,7 @@ function registerTrainOperationsCommands(program3, runProjectInfoSyncCallback) {
     return [
       `mmi-cli devops hotfix status: ${r.tag} on ${r.repo} \u2014 ${r.state}`,
       `  - branch: ${r.branchExists ? "pushed" : "absent"} \u2014 PR: ${r.pr ? `#${r.pr.number} ${r.pr.state}` : "none"} \u2014 tag: ${r.tagPushed ? "pushed" : "absent"} \u2014 Release: ${r.releaseExists ? "exists" : "absent"}`,
-      ...r.runs.map((run) => `  - ${run.workflow}: ${run.conclusion}${run.conclusion === "failure" ? " \u2014 error: workflow reported failure" : ""}${run.url ? ` (${run.url})` : ""}`),
+      ...r.runs.map(formatHotfixRun),
       `  - development fold alignment: ${r.alignmentStatus}${r.alignmentNote ? ` \u2014 ${r.alignmentNote}` : ""}`,
       `  - npm @mutmutco/cli: ${r.npmVersion}`,
       `  - next: ${r.next}`,
@@ -42662,36 +42974,23 @@ function registerTrainOperationsCommands(program3, runProjectInfoSyncCallback) {
     if (conclusion === "failure") return "failure";
     return "unresolved";
   }
-  function hotfixFollowUpLegs(runs, foldPort, alignment, foldNote) {
-    const legs = runs.map((run) => ({
-      leg: run.workflow,
-      status: followUpLegStatus(run.conclusion === "failure" ? "failure" : run.conclusion === "success" ? "success" : "pending"),
-      ...run.conclusion === "failure" ? { error: "workflow reported failure" } : {}
-    }));
-    if (foldPort === "failure") {
-      legs.push({ leg: "development-fold-port", status: "failed", error: foldNote ?? "development fold port failed" });
-    }
-    if (alignment === "unresolved") {
-      legs.push({ leg: "development-fold-alignment", status: "pending" });
-    } else if (alignment === "failure" && foldPort !== "failure") {
-      legs.push({ leg: "development-fold-alignment", status: "failed", error: foldNote ?? "development fold alignment failed" });
-    }
-    return legs;
-  }
   async function runHotfixSub(sub, body, o, render) {
     try {
       await requireFreshTrainCli("hotfix");
-      const result = await body();
+      const raw = await body();
+      const rawRuns = raw.runs;
+      const result = rawRuns ? Object.assign({}, raw, { runs: rawRuns.map(hotfixRunWithEvidence) }) : raw;
       const runs = result.runs;
       const foldPort = result.foldStatus ?? "ok";
       const ledger = result.ledger;
       const alignment = result.alignmentStatus ?? ledgerAlignmentFollowUpOutcome(ledger);
       const projectInfoSync = result.projectInfoSync;
-      const legs = runs ? hotfixFollowUpLegs(runs, foldPort, alignment, result.foldNote) : void 0;
+      const deployNote = result.deployNote ?? ledger?.phases.deploy.error ?? ledger?.phases.deploy.note;
+      const legs = runs ? hotfixFollowUpLegs(runs, foldPort, alignment, result.foldNote, deployNote) : void 0;
       const json = o.json || Boolean(hotfixCmd.opts().json);
       emitTrainResult(`hotfix ${sub}`, json ? JSON.stringify(legs ? Object.assign({}, result, { legs }) : result, null, 2) : render(result), o.out);
       if (runs) applyTrainFollowUpExit(deriveTrainFollowUpStatus({
-        projectInfo: projectInfoSync && "error" in projectInfoSync ? "failure" : "ok",
+        projectInfo: projectInfoOutcome(projectInfoSync),
         deploy: reduceFollowUpOutcomes(runs.map((r) => hotfixRunOutcome(r.conclusion))),
         rcRetirement: "ok",
         alignment,
@@ -42715,13 +43014,7 @@ function registerTrainOperationsCommands(program3, runProjectInfoSyncCallback) {
   hotfixCmd.command("release <version>").description("after the hotfix PR is merged + checks green: tag, GitHub Release, watch deploy/publish, verify distribution (idempotent)").option("--json", "machine-readable output").option("--announce-summary-file <path>", "agent-curated 3-6 line Hub Slack summary; required for a NEW MMI-Hub hotfix Release (#883/#3901/#6068)").option("--carries <pr#|sha[,pr#|sha...]>", "declared fix target(s) this hotfix must carry; each must be proven present before tagging (#3056)").option("--out <path>", "write the result to this file as UTF-8 (no BOM) instead of stdout \u2014 the shell-free receipt path (#5983/#6068)").action(async (version, o) => runHotfixSub("release", async () => {
     const result = await runHotfixRelease(trainApplyDeps(), version, { announceSummaryFile: o.announceSummaryFile, carries: o.carries ? [o.carries] : [] });
     const postReleaseJervDoctor = await runPostReleaseJervDoctor(result.repo);
-    let projectInfoSync;
-    try {
-      projectInfoSync = await runProjectInfoSyncCallback(result.repo, true);
-    } catch (e) {
-      const error = e.message;
-      projectInfoSync = { applied: false, note: `FAILED \u2014 ${error}`, error };
-    }
+    const projectInfoSync = await runProjectInfoSyncLeg(runProjectInfoSyncCallback, result.repo);
     return { ...result, projectInfoSync, ...postReleaseJervDoctor ? { postReleaseJervDoctor } : {} };
   }, o, renderHotfixRelease));
   function hotfixStatusDeps() {
@@ -43302,7 +43595,7 @@ tenant.command("reconcile <owner/repo> <stage>").description("re-render this ten
     return failGraceful(`runtime tenant reconcile: ${e.message}`);
   }
 });
-tenant.command("status <owner/repo> <stage>").description("read tenant runtime readiness without dispatching tenant-control: DEPLOY row, last deploy run, public URL probe, and TLS/Caddy/Cloudflare hints").action(async (repo, stage) => {
+tenant.command("status <owner/repo> <stage>").description("read tenant runtime readiness without dispatching tenant-control: DEPLOY row, last deploy run, public URL probe, and TLS/Caddy/Cloudflare hints; an auth-walled root (401/403) is re-probed at /health and the `url` field names the endpoint that answered (#6137)").action(async (repo, stage) => {
   if (!["dev", "rc", "main"].includes(stage)) return fail("runtime tenant status: <stage> must be dev, rc, or main");
   const cfg = await loadConfig();
   const result = await buildTenantRuntimeStatusFor(repo, stage, cfg);
@@ -43312,7 +43605,8 @@ tenant.command("status <owner/repo> <stage>").description("read tenant runtime r
 tenant.command("redeploy <owner/repo> <stage>").description("re-dispatch the central tenant-deploy.yml for an already-promoted ref (no re-tag/merge); train-authority gated").option("--ref <ref>", "ref to deploy (defaults to the stage branch rc/main, or `development` for dev \u2014 the promoted/staging ref)").option("--watch", "block on the dispatched run and report its outcome (gh run watch --exit-status)").option("--json", "machine-readable output").action(async (repo, stage, o) => {
   if (stage !== "dev" && stage !== "rc" && stage !== "main") return fail("runtime tenant redeploy: <stage> must be dev, rc, or main");
   try {
-    const result = await runTenantRedeploy(trainApplyDeps(), { repo, stage, ref: o.ref, watch: o.watch });
+    const raw = await runTenantRedeploy(trainApplyDeps(), { repo, stage, ref: o.ref, watch: o.watch });
+    const result = raw.workflowRuns ? { ...raw, workflowRuns: raw.workflowRuns.map(workflowRunWithEvidence) } : raw;
     return printLine(o.json ? JSON.stringify(result, null, 2) : renderTenantRedeploy(result));
   } catch (e) {
     return failGraceful(`runtime tenant redeploy: ${e.message}`);
@@ -43343,26 +43637,13 @@ tenant.command("sweep-rc").description("discover (and optionally retire) running
     return failGraceful(`runtime tenant sweep-rc: ${e.message}`);
   }
 });
-async function probeHttpBounded2(url, timeoutMs = 5e3) {
-  const controller = new AbortController();
-  const timeout = setTimeout(() => controller.abort(), timeoutMs);
-  timeout.unref?.();
-  try {
-    const res = await fetch(url, { method: "GET", signal: controller.signal });
-    return { ok: res.ok, status: res.status };
-  } catch (e) {
-    return { ok: false, error: e.message };
-  } finally {
-    clearTimeout(timeout);
-  }
-}
 async function buildTenantRuntimeStatusFor(target, stage, cfg) {
   const slug = slugOf(target);
   const reg = registryClientDeps(cfg);
   const facts = await fetchDeployFactsBySlug(slug, reg);
   const deploy = facts?.stages[stage] ?? null;
   const publicUrl = publicUrlFromDeployFact(deploy);
-  const publicProbe = publicUrl ? await probeHttpBounded2(publicUrl) : void 0;
+  const publicProbe = publicUrl ? await probePublicHealth(publicUrl) : void 0;
   return buildTenantRuntimeStatus({
     repo: target,
     slug,
@@ -43390,9 +43671,9 @@ async function runProjectInfoSync(target, apply) {
     fetchProjectBySlugChecked(slugOf(targetRepo2), registry2),
     fetchProjectsList(registry2)
   ]);
-  if (!read.ok) throw new Error(`org project sync-info: Hub registry read failed (${read.error})`);
+  if (!read.ok) throw new ProjectInfoReadUnavailableError(`org project sync-info: Hub registry read failed (${read.error})`);
   if (!read.project) throw new Error(`org project sync-info: no registry META for ${targetRepo2}`);
-  if (!projects) throw new Error("org project sync-info: Hub project list unavailable");
+  if (!projects) throw new ProjectInfoReadUnavailableError("org project sync-info: Hub project list unavailable");
   if (apply) {
     const authority = await fetchTrainAuthority(targetRepo2, registry2);
     if (!authority.ok) throw new Error(`org project sync-info: train authority unverified (${authority.error})`);