@mutmutco/cli 4.3.7 → 4.3.9

package/dist/main.cjs

@@ -5226,7 +5226,7 @@ function unknownCommandDomainGuide(parentPath, token) {
 }
 
 // src/command-composition.ts
-var import_node_os20 = require("node:os");
+var import_node_os21 = require("node:os");
 var import_node_path46 = require("node:path");
 
 // src/board-read.ts
@@ -6998,6 +6998,19 @@ function isPromotionBase(base, track) {
 }
 
 // src/readiness-audit.ts
+async function probeHttpBounded(url, timeoutMs = 5e3) {
+  try {
+    const res = await fetch(url, { method: "GET", signal: AbortSignal.timeout(timeoutMs) });
+    return { ok: res.ok, status: res.status, url };
+  } catch (e) {
+    return { ok: false, error: e.message, url };
+  }
+}
+async function probePublicHealth(publicUrl) {
+  const root = await probeHttpBounded(publicUrl);
+  if (root.status !== 401 && root.status !== 403) return root;
+  return probeHttpBounded(`${publicUrl.replace(/\/$/, "")}/health`);
+}
 var TENANT_DEPLOY_RUN_SCAN_LIMIT = 100;
 function pickTenantDeployRun(rows, slug, stage) {
   const escaped = slug.replace(/[.*+?^${}()|[\]\\-]/g, "\\$&");
@@ -7016,7 +7029,8 @@ function tenantRuntimeHints(stage, fact, probe) {
   if (!fact.sshHostPresent && fact.substrate === "hetzner-ssh") hints.push(`DEPLOY#${stage} has hetzner-ssh substrate but no sshHost presence; tenant-deploy cannot reach the box.`);
   if (!fact.domain) hints.push(`DEPLOY#${stage} has no edgeVhost.domain; Cloudflare/Caddy public URL cannot be derived.`);
   if (typeof fact.port !== "number") hints.push(`DEPLOY#${stage} has no edgeVhost.port; Caddy upstream/healthUrl hints cannot be checked.`);
-  if (probe?.ok === false || probe?.status != null && probe.status >= 500) hints.push("Public URL probe failed; for Cloudflare 525 check Caddy TLS/origin certificate and Cloudflare SSL mode before changing app code.");
+  if (probe?.url?.endsWith("/health") && probe.ok === false) hints.push(`Root is auth-walled (401/403) and ${probe.url} answered ${probe.status ?? probe.error}; expose a 2xx /health route or fix the app \u2014 the edge is fine.`);
+  else if (probe?.ok === false || probe?.status != null && probe.status >= 500) hints.push("Public URL probe failed; for Cloudflare 525 check Caddy TLS/origin certificate and Cloudflare SSL mode before changing app code.");
   if (stage === "rc") hints.push("rc runtime is expected to be ephemeral: present between /rcand and /release, then retired after release.");
   return hints;
 }
@@ -9435,7 +9449,7 @@ function invalidReference(ref) {
   return new Error(`invalid reference "${ref}" \u2014 expected ${ISSUE_REF_SHAPES}`);
 }
 function parseIssueRef(ref, expectedRepo) {
-  const trimmed = ref.trim();
+  const trimmed = String(ref).trim();
   const url = trimmed.match(/^https:\/\/github\.com\/([^/]+\/[^/]+)\/(?:issues|pull)\/(\d+)$/i);
   const qualified = trimmed.match(/^([^/\s#]+\/[^/\s#]+)#(\d+)$/);
   const bare = trimmed.match(/^#?(\d+)$/);
@@ -11061,14 +11075,7 @@ function writableOrUnknown(writable) {
 function renderBoardSource() {
   return "source: live";
 }
-async function readBoard(options, deps = {}) {
-  const cfg = resolveBoardConfig(options.config);
-  const client = deps.client ?? defaultGitHubClient();
-  let collected;
-  let writable;
-  let pullRequests;
-  let github;
-  let snapshotFallback;
+async function collectBoardPreferringSnapshot(cfg, options, deps) {
   const attempt = deps.snapshot ? await fetchHubBoardSnapshot(
     {
       owner: cfg.projectOwner,
@@ -11094,19 +11101,37 @@ async function readBoard(options, deps = {}) {
       warnings.push(message2);
       partial = true;
     }
+    return {
+      collected: {
+        items: read.items,
+        viewer: snapshot.viewer,
+        repo: currentRepo,
+        projectId: snapshot.project.id,
+        projectTitle: snapshot.project.title,
+        warnings,
+        partial
+      },
+      snapshot
+    };
+  }
+  const collected = await collectBoardItems(cfg, { repo: options.repo, allowPartial: options.allowPartial, activeOnly: true }, deps);
+  if (attempt?.state === "unavailable") {
+    collected.warnings.push(`Hub board snapshot unavailable (${attempt.reason}) \u2014 served by the direct user-auth read (emergency fallback)`);
+  }
+  return { collected };
+}
+async function readBoard(options, deps = {}) {
+  const cfg = resolveBoardConfig(options.config);
+  const client = deps.client ?? defaultGitHubClient();
+  const { collected, snapshot } = await collectBoardPreferringSnapshot(cfg, options, deps);
+  let writable;
+  let pullRequests;
+  let github;
+  if (snapshot) {
     for (const unreadable of snapshot.unreadableRepos) {
-      warnings.push(`partial claimable access read: ${unreadable.repo}: viewer write access UNREAD (${unreadable.error})`);
-      partial = true;
+      collected.warnings.push(`partial claimable access read: ${unreadable.repo}: viewer write access UNREAD (${unreadable.error})`);
+      collected.partial = true;
     }
-    collected = {
-      items: read.items,
-      viewer: snapshot.viewer,
-      repo: currentRepo,
-      projectId: snapshot.project.id,
-      projectTitle: snapshot.project.title,
-      warnings,
-      partial
-    };
     writable = {
       repos: new Set(snapshot.writableRepos.map((repo) => repo.toLowerCase())),
       unknown: new Set(snapshot.unreadableRepos.map((entry) => entry.repo.toLowerCase()))
@@ -11114,11 +11139,6 @@ async function readBoard(options, deps = {}) {
     pullRequests = snapshot.pullRequests;
     github = snapshot.github;
   } else {
-    if (attempt?.state === "unavailable") snapshotFallback = attempt.reason;
-    collected = await collectBoardItems(cfg, { repo: options.repo, allowPartial: options.allowPartial, activeOnly: true }, deps);
-    if (snapshotFallback) {
-      collected.warnings.push(`Hub board snapshot unavailable (${snapshotFallback}) \u2014 served by the direct user-auth read (emergency fallback)`);
-    }
     const probed = await resolveWritableReposForClaimables(collected.items, client);
     collected.warnings.push(...probed.warnings);
     collected.partial = collected.partial || probed.partial;
@@ -12057,21 +12077,45 @@ async function moveBoardItem(options, deps = {}) {
     partial: false
   };
 }
-async function prepareClaimContext(options, selectors, deps, collected) {
+async function resolveClaimWritable(collected, client, snapshot, unscanned) {
+  const probe = async (items) => {
+    const probed2 = await resolveWritableReposForClaimables(items, client);
+    collected.warnings.push(...probed2.warnings);
+    collected.partial = collected.partial || probed2.partial;
+    return probed2;
+  };
+  if (!snapshot) {
+    const probed2 = await probe(collected.items);
+    return { repos: probed2.repos, unknown: probed2.unknown };
+  }
+  for (const unreadable of snapshot.unreadableRepos) {
+    collected.warnings.push(`partial claimable access read: ${unreadable.repo}: viewer write access UNREAD (${unreadable.error})`);
+    collected.partial = true;
+  }
+  const repos = new Set(snapshot.writableRepos.map((repo) => repo.toLowerCase()));
+  const unknown = new Set(snapshot.unreadableRepos.map((entry) => entry.repo.toLowerCase()));
+  const missed = unscanned.filter((item) => !repos.has(item.repository.toLowerCase()) && !unknown.has(item.repository.toLowerCase()));
+  if (!missed.length) return { repos, unknown };
+  const probed = await probe(missed);
+  return { repos: /* @__PURE__ */ new Set([...repos, ...probed.repos]), unknown: /* @__PURE__ */ new Set([...unknown, ...probed.unknown]) };
+}
+async function prepareClaimContext(options, selectors, deps, collected, snapshot) {
   const cfg = resolveBoardConfig(options.config);
   const client = deps.client ?? defaultGitHubClient();
   const board = { owner: cfg.projectOwner, number: cfg.projectNumber };
+  const unscanned = [];
   for (const selector of selectors) {
     try {
       findBoardItem(collected.items, selector, board);
     } catch {
       const fallback = (await fetchIssueProjectItem(client, cfg, selector)).item;
-      if (fallback) collected.items.push(fallback);
+      if (fallback) {
+        collected.items.push(fallback);
+        unscanned.push(fallback);
+      }
     }
   }
-  const writable = await resolveWritableReposForClaimables(collected.items, client);
-  collected.warnings.push(...writable.warnings);
-  collected.partial = collected.partial || writable.partial;
+  const writable = await resolveClaimWritable(collected, client, snapshot, unscanned);
   const report = {
     project: { owner: cfg.projectOwner, number: cfg.projectNumber, id: collected.projectId, title: collected.projectTitle || String(cfg.projectNumber) },
     viewer: collected.viewer,
@@ -12209,14 +12253,15 @@ async function claimOneBoardItem(ctx, selector, options) {
 }
 async function claimBoardIssue(options, deps = {}) {
   const cfg = resolveBoardConfig(options.config);
-  const collected = await collectBoardItems(cfg, { repo: options.repo, allowPartial: options.allowPartial, activeOnly: true }, deps);
+  const { collected, snapshot } = await collectBoardPreferringSnapshot(cfg, options, deps);
   const selector = parseIssueSelector(options.selector, collected.repo, options.repo);
-  const ctx = await prepareClaimContext(options, [selector], deps, collected);
-  return claimOneBoardItem(ctx, selector, options);
+  const ctx = await prepareClaimContext(options, [selector], deps, collected, snapshot);
+  const result = await claimOneBoardItem(ctx, selector, options);
+  return ctx.report.warnings.length ? { ...result, warnings: [...ctx.report.warnings] } : result;
 }
 async function claimBoardIssues(options, deps = {}) {
   const cfg = resolveBoardConfig(options.config);
-  const collected = await collectBoardItems(cfg, { repo: options.repo, allowPartial: options.allowPartial, activeOnly: true }, deps);
+  const { collected, snapshot } = await collectBoardPreferringSnapshot(cfg, options, deps);
   const selectors = [];
   const seen = /* @__PURE__ */ new Set();
   for (const raw of options.selectors) {
@@ -12226,7 +12271,7 @@ async function claimBoardIssues(options, deps = {}) {
     seen.add(key);
     selectors.push(selector);
   }
-  const ctx = await prepareClaimContext(options, selectors, deps, collected);
+  const ctx = await prepareClaimContext(options, selectors, deps, collected, snapshot);
   const results = new Array(selectors.length);
   let next = 0;
   const worker = async () => {
@@ -12247,7 +12292,9 @@ async function claimBoardIssues(options, deps = {}) {
     viewer: ctx.report.viewer,
     repo: ctx.report.repo,
     results,
-    failed: results.filter((result) => !result.claimed).length
+    failed: results.filter((result) => !result.claimed).length,
+    // #6162: as in claimBoardIssue — the emergency user-auth fallback is named with the verdict.
+    ...ctx.report.warnings.length ? { warnings: [...ctx.report.warnings] } : {}
   };
 }
 async function moveBoardIssues(options, deps = {}) {
@@ -15403,10 +15450,10 @@ var rollout_plan_default = {
     note: "The v4.0.0 stamp happens at cut time (D6e #4463); until then the candidate is the origin/development head artifacts (built cli/dist + npm pack), identity proven by dist content hash (D6a)."
   },
   baseline: {
-    version: "4.3.7",
-    tag: "v4.3.7",
-    commit: "d7f9efaf3e66",
-    npm: "@mutmutco/cli@4.3.7"
+    version: "4.3.9",
+    tag: "v4.3.9",
+    commit: "64fc1be95e37",
+    npm: "@mutmutco/cli@4.3.9"
   },
   exitCriterion: "fleet-n-of-n",
   hubOnlyShortcut: "forbidden",
@@ -15423,14 +15470,14 @@ var rollout_plan_default = {
           repo: "mutmutco/mmi-hub",
           role: "canary",
           schedule: "train",
-          v3Target: "v4.3.7"
+          v3Target: "v4.3.9"
         }
       ],
       rollbackTrigger: "Any red inside the post-contract soak window: `devops train gate` FAIL attributable to the v4 doors, Hub endpoint health probe failure, a pre-v4 client admitted instead of receiving actionable HTTP 426, or npm consumer install/doctor failure on the v4-only dist.",
       rollback: {
         independent: true,
-        mechanism: "npm dist-tag latest -> 4.3.7 and redeploy the Hub Lambda from tag v4.3.7 (d7f9efaf3e66); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
-        v3Target: "v4.3.7 (@mutmutco/cli@4.3.7, tag commit d7f9efaf3e66 \u2014 last known-good release carrying the repo-index v4-only contract)"
+        mechanism: "npm dist-tag latest -> 4.3.9 and redeploy the Hub Lambda from tag v4.3.9 (64fc1be95e37); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
+        v3Target: "v4.3.9 (@mutmutco/cli@4.3.9, tag commit 64fc1be95e37 \u2014 last known-good release carrying the repo-index v4-only contract)"
       }
     },
     {
@@ -18286,7 +18333,8 @@ async function appendJervGatewayReleaseDeploy(deps, repo, tag, tagSha, dispatch)
   if (dispatch.deployStatus !== "success") {
     return {
       ...dispatch,
-      note: `${dispatch.note}; Jerv Gateway deploy deferred until package publication is proven green`
+      note: `${dispatch.note}; Jerv Gateway deploy deferred until package publication is proven green`,
+      workflowRuns: [...dispatch.workflowRuns ?? [], { workflow: "jerv-gateway", runUrlNote: JERV_GATEWAY_RUN_URL_NOTE, conclusion: "pending" }]
     };
   }
   try {
@@ -18964,6 +19012,7 @@ Resume it:  ${resumeCommand}
 
 // src/train-doctor.ts
 var import_node_fs23 = require("node:fs");
+var import_node_os13 = require("node:os");
 var import_node_path22 = require("node:path");
 
 // src/doctor-io.ts
@@ -20599,8 +20648,11 @@ function deployPhaseInput(model, dispatch, opts = {}) {
         note: deployRun ? `${deployRun.workflow} release run` : dispatch.note
       };
     }
-    case "registry-publish":
+    case "registry-publish": {
+      const hostRun = (dispatch.workflowRuns ?? []).find((r) => r.workflow === "jerv-gateway");
+      if (hostRun) return { state: runRowState(hostRun, dispatch.deployStatus), ...sha ? { sha } : {}, workflow: hostRun.workflow, note: dispatch.note };
       return { state: "skipped", ...sha ? { sha } : {}, note: "registry-publish deploys by publishing \u2014 the release-event publish.yml run is the deploy plane" };
+    }
     case "tenant-container":
     case "solo-container":
     case "static-cdn":
@@ -20661,6 +20713,7 @@ function releasePhaseInputsFromDispatch(model, dispatch, publishDispatch, publis
 function phaseInputsFromRunRows(model, rows, tagSha, opts = {}) {
   const deployRun = rows.find((r) => r.workflow === "deploy.yml");
   const publishRun = rows.find((r) => r.workflow === "publish.yml");
+  const hostRun = rows.find((r) => r.workflow === "jerv-gateway");
   switch (model) {
     case "hub-serverless":
       return {
@@ -20679,7 +20732,9 @@ function phaseInputsFromRunRows(model, rows, tagSha, opts = {}) {
       };
     case "registry-publish":
       return {
-        deploy: { state: "skipped", sha: tagSha, note: "registry-publish deploys by publishing \u2014 the release-event publish.yml run is the deploy plane" },
+        // #884/#6145: an operator-host deploy leg (Jerv-Hub's Gateway) outranks 'skipped' here exactly as
+        // in deployPhaseInput — it carries no runId, so no run metadata and no resume re-verification.
+        deploy: hostRun ? { state: runRowState(hostRun, "pending"), sha: tagSha, workflow: hostRun.workflow, note: "jerv-gateway operator-host deploy on the release SHA" } : { state: "skipped", sha: tagSha, note: "registry-publish deploys by publishing \u2014 the release-event publish.yml run is the deploy plane" },
         publish: publishRun ? {
           state: runRowState(publishRun, "pending"),
           sha: tagSha,
@@ -21046,12 +21101,14 @@ async function selfConvergeTrainCli(input) {
 var TRAIN_LANES = ["release", "rcand", "hotfix"];
 var TROUBLESHOOTING_GUIDE = "docs/Guides/train-troubleshooting.md";
 var SCRATCH_BRANCH_GLOBS = ["train/check/*", "hotfix-fold/*--port-*"];
+var COMPOSE_GUARD_HARD_FAIL = /^secrets preflight: .*noEnvFile is (not )?true.*$/m;
 function readLocalWorkflowsDefault(root) {
   const dir = (0, import_node_path22.join)(root, ".github", "workflows");
   let names;
   try {
     names = (0, import_node_fs23.readdirSync)(dir);
-  } catch {
+  } catch (e) {
+    if (e.code === "ENOENT") return [];
     return null;
   }
   const files = [];
@@ -21063,6 +21120,25 @@ function readLocalWorkflowsDefault(root) {
   }
   return files;
 }
+var NPM_REGISTRY = "https://registry.npmjs.org";
+async function probeRegistryWhoami(train) {
+  const dir = (0, import_node_fs23.mkdtempSync)((0, import_node_path22.join)((0, import_node_os13.tmpdir)(), "mmi-npmrc-"));
+  const rc = (0, import_node_path22.join)(dir, "npmrc");
+  try {
+    (0, import_node_fs23.writeFileSync)(rc, "//registry.npmjs.org/:_authToken=${NPM_TOKEN}\n");
+    await train.runSelf(["secrets", "use", "npm/NPM_TOKEN", "--slug", "_org", "--", "npm", "whoami", "--registry", NPM_REGISTRY, "--userconfig", rc]);
+    return { kind: "ok", detail: "the registry answered a login" };
+  } catch (e) {
+    const err = e;
+    const stderr = typeof err.stderr === "string" ? err.stderr : "";
+    const first = (clean2(stderr) || message(e)).split("\n")[0] ?? "";
+    if (err.code === SECRETS_USE_WRAPPER_EXIT_CODE) return { kind: "unprobed", detail: first };
+    if (/\bE401\b|401 Unauthorized/.test(stderr)) return { kind: "rejected", detail: "npm whoami answered 401 Unauthorized" };
+    return { kind: "unverified", detail: first };
+  } finally {
+    (0, import_node_fs23.rmSync)(dir, { recursive: true, force: true });
+  }
+}
 var defaultDeps2 = {
   cliVersion: resolveClientVersion,
   fetchReleasedVersion: fetchNpmReleasedVersion,
@@ -21080,6 +21156,14 @@ var defaultDeps2 = {
     }
   },
   healAlignmentLeg: healStaleAlignmentLeg,
+  readSurfacesRaw: (cwd) => {
+    try {
+      return (0, import_node_fs23.readFileSync)((0, import_node_path22.join)(cwd, "surfaces.json"), "utf8");
+    } catch {
+      return void 0;
+    }
+  },
+  registryWhoami: probeRegistryWhoami,
   env: process.env
 };
 function message(e) {
@@ -21281,12 +21365,12 @@ async function runTrainDoctor(input) {
       ...!hints.hasMainBranch ? ["main"] : [],
       ...!hints.hasRcBranch && track === "full" ? ["rc"] : []
     ];
-    if (missing.length) add({ code: "bootstrap-gap", severity: "blocker", source: "origin", title: `train branch(es) missing on origin: ${missing.join(", ")}`, remedy: `bootstrap the repo train: \`mmi-cli bootstrap apply ${repo} --execute\` (from the MMI-Hub root), then rerun` });
+    if (missing.length) add({ code: "bootstrap-gap", severity: "blocker", source: "origin", title: `train branch(es) missing on origin: ${missing.join(", ")}`, remedy: `bootstrap the repo train: \`mmi-cli devops bootstrap apply ${repo} --execute\` (from the MMI-Hub root), then rerun` });
   }
   try {
     const required = await discoverRequiredCheckContexts(train, ctx, stage);
     if (required.length === 0) {
-      add({ code: "bootstrap-gap", severity: "blocker", source: "origin", title: `no ruleset requires a status check on ${stage} \u2014 the train would tag without a gate`, remedy: `activate the product ruleset: \`mmi-cli bootstrap apply ${repo} --execute\` (from the MMI-Hub root), or \`mmi-cli devops ci audit --repo ${repo}\`` });
+      add({ code: "bootstrap-gap", severity: "warning", source: "origin", title: `no ruleset requires a status check on ${stage} \u2014 the train tags without a check wait (the GitHub push gate is the backstop)`, remedy: `activate the product ruleset: \`mmi-cli devops bootstrap apply ${repo} --execute\` (from the MMI-Hub root), or \`mmi-cli devops ci audit --repo ${repo}\`` });
     } else {
       try {
         assertTagAddressableRequiredContexts({ readWorkflows: () => workflows }, required, repo);
@@ -21357,13 +21441,25 @@ async function runTrainDoctor(input) {
       add({ code: "npm-major-mismatch", severity: "blocker", source: "local", title: "local npm major differs from the npm CI declares (#5666)", remedy: message(e) });
     }
   }
+  if (/"publishVisibility"\s*:\s*"private"/.test(deps.readSurfacesRaw(cwd) ?? "")) {
+    const probe = await deps.registryWhoami(train);
+    if (probe.kind === "rejected") {
+      add({ code: "npm-token-rejected", severity: "warning", source: "origin", title: `the vault npm token (_org npm/NPM_TOKEN) is REJECTED by registry.npmjs.org \u2014 ${probe.detail}; every authenticated \`npm view\` of a restricted package will 404 exactly like an absent one`, remedy: 'rotate the org token: mint a fresh npm automation token, store it with `mmi-cli vault secrets set npm/NPM_TOKEN --slug _org` (master or an exact grant), and rerun. Until whoami answers a login, a restricted-package 404 proves nothing \u2014 never read it as "not published" (#6184)' });
+    } else if (probe.kind === "unprobed") {
+      add({ code: "npm-token-rejected", severity: "info", source: "origin", title: `the vault npm token was not probed (no _org npm/NPM_TOKEN grant, or a vault error): ${probe.detail}`, remedy: "nothing here \u2014 the release does not depend on it (CI publishes through OIDC Trusted Publishing). Before verifying a private publish by hand, run the whoami probe from an account holding the `_org` npm/NPM_TOKEN grant" });
+    } else if (probe.kind === "unverified") {
+      unverified("the vault npm token (`npm whoami` through the `_org` npm/NPM_TOKEN hop)", probe.detail);
+    }
+  }
   try {
-    await train.runSelf(["secrets", "preflight", "--stage", stage, "--repo", repo]);
+    await train.runSelf(["secrets", "preflight", "--stage", stage, "--repo", repo, ...lane === "hotfix" ? ["--lane", "hotfix"] : []]);
   } catch (e) {
     const err = e;
     const text = [typeof err.stdout === "string" ? err.stdout : "", typeof err.stderr === "string" ? err.stderr : "", message(e)].join("\n");
     if (/^missing /m.test(text)) {
-      add({ code: "secrets-missing", severity: "blocker", source: "origin", title: `required ${stage} secret name(s) are absent: ${clean2(text.match(/^missing .*$/m)?.[0] ?? "")}`, remedy: `provision them in the vault (\`mmi-cli vault secrets request <KEY> --repo ${repo}\`), then rerun \`mmi-cli vault secrets preflight --stage ${stage} --repo ${repo}\`` });
+      add({ code: "secrets-missing", severity: "blocker", source: "origin", title: `required ${stage} secret name(s) are absent: ${clean2(text.match(/^missing .*$/m)?.[0] ?? "")}`, remedy: `provision them in the vault (\`mmi-cli vault secrets request <KEY> --repo ${repo}\`), then rerun \`mmi-cli vault secrets preflight --stage ${stage} --repo ${repo}${lane === "hotfix" ? " --lane hotfix" : ""}\`` });
+    } else if (COMPOSE_GUARD_HARD_FAIL.test(text)) {
+      add({ code: "compose-guard-mismatch", severity: "blocker", source: "origin", title: clean2(text.match(COMPOSE_GUARD_HARD_FAIL)?.[0] ?? text), remedy: `fix the compose/DEPLOY#${stage}.noEnvFile pair per the fileless-transition guide the preflight printed, then rerun \`mmi-cli vault secrets preflight --stage ${stage} --repo ${repo}${lane === "hotfix" ? " --lane hotfix" : ""}\`; --skip-compose-guard only after independent verification (#2813)` });
     } else {
       unverified(`the ${stage} secrets preflight`, clean2(text) || e);
     }
@@ -21553,7 +21649,7 @@ function enforceGateBudget(deps, repo) {
     );
   }
 }
-async function preflight(deps, ctx, stage, meta) {
+async function preflight(deps, ctx, stage, meta, lane) {
   const model = requireDeployModel(meta, ctx.repo);
   if (model === "content") {
     throw new Error(`${ctx.repo} is a content repo (deployModel=content) \u2014 the release train does not apply (trunk-based; PR to main)`);
@@ -21561,7 +21657,7 @@ async function preflight(deps, ctx, stage, meta) {
   if (model === "none") {
     throw new Error(`${ctx.repo} is not Hub-deployed (deployModel=none) \u2014 the release train does not apply; use the project's own release path`);
   }
-  await deps.runSelf(["secrets", "preflight", "--stage", stage, "--repo", ctx.repo]);
+  await deps.runSelf(["secrets", "preflight", "--stage", stage, "--repo", ctx.repo, ...lane === "hotfix" ? ["--lane", "hotfix"] : []]);
   await assertNpmMajorPreflightFromWorkflows(deps, ctx.repo);
   await assertActionsJobsCanStart(deps, ctx.repo);
   enforceGateBudget(deps, ctx.repo);
@@ -22207,7 +22303,7 @@ ${recovery.note}`), recoveryInput);
   const deployRunRepo = releaseRunRepoFor(deployModel, ctx.repo);
   const failedReleaseRun = deployDispatch0.workflowRuns?.find((run) => run.conclusion === "failure");
   const dispatchFailurePhase = failedReleaseRun?.workflow === "publish.yml" || deployModel === "registry-publish" ? "publish" : "deploy";
-  const deployDispatch = await recoverFailedDispatchPhase(
+  const recoveredDeployDispatch = await recoverFailedDispatchPhase(
     deps,
     ledger,
     ledgerAnchors,
@@ -22220,6 +22316,7 @@ ${recovery.note}`), recoveryInput);
       workflow: failedReleaseRun?.workflow ?? (isCentralDispatchModel(deployModel) ? "tenant-deploy.yml" : "deploy workflow")
     }
   );
+  const deployDispatch = await appendJervGatewayReleaseDeploy(deps, ctx.repo, tag, releaseSha, recoveredDeployDispatch);
   await recordPhase(ledger, deps, ledgerAnchors, "deploy", phaseEntry(deployPhaseInput(deployModel, deployDispatch, { releaseSha })), {
     landed: "the immutable tag, the green required-check wall, the origin/main fast-forward, and the verified GitHub Release"
   });
@@ -22244,7 +22341,6 @@ ${recovery.note}`), recoveryInput);
     landed: "the immutable tag, the green required-check wall, origin/main, the verified GitHub Release, and the dispatched deploy path"
   });
   let dispatch = appendPublishDispatch(deployDispatch, publishDispatch);
-  dispatch = await appendJervGatewayReleaseDeploy(deps, ctx.repo, tag, releaseSha, dispatch);
   if (publishSkipNote) dispatch = { ...dispatch, note: `${dispatch.note}; tenant-publish.yml skipped (${publishSkipNote})` };
   return { checks, releaseUrl, announceNote, dispatch, ledgerAnchors };
 }
@@ -22520,17 +22616,18 @@ Nothing was written. Inspect ${ledger.path} (or clear it only after proving the
       historicalDeploy = historicalTargets.length ? aggregateWorkflowRuns(historicalRows) : recovered.deployStatus;
       historicalNote = recovered.note;
     }
+    const dispatch2 = await appendJervGatewayReleaseDeploy(deps, ctx.repo, tag, tagSha, {
+      note: historicalNote,
+      deployStatus: historicalDeploy,
+      workflowRuns: historicalRows
+    });
     if (persisted) {
-      const phaseInputs = phaseInputsFromRunRows(deployModel, historicalRows, tagSha, { repo: ctx.repo });
+      const phaseInputs = phaseInputsFromRunRows(deployModel, dispatch2.workflowRuns ?? historicalRows, tagSha, { repo: ctx.repo });
       await recordPhase(ledger, deps, anchors, "deploy", phaseEntry(phaseInputs.deploy), { strict: true, landed: "the verified GitHub Release and origin/main at the immutable tag SHA" });
       await recordPhase(ledger, deps, anchors, "publish", phaseEntry(phaseInputs.publish), { strict: true, landed: "the verified GitHub Release and origin/main at the immutable tag SHA" });
       await recordPhase(ledger, deps, anchors, "githubRelease", phaseEntry({ state: "complete", sha: tagSha, note: "re-verified live: the GitHub Release exists at the immutable tag SHA" }), { strict: true, landed: "the promotion (verified live)" });
       await recordPhase(ledger, deps, anchors, "promotion", phaseEntry({ state: "complete", sha: tagSha, note: "re-verified live: origin/main contains the immutable tag SHA" }), { strict: true, landed: "nothing beyond the already-public release" });
     }
-    const dispatch2 = await appendJervGatewayReleaseDeploy(deps, ctx.repo, tag, tagSha, {
-      note: historicalNote,
-      deployStatus: historicalDeploy
-    });
     if (isJervHubRepo(ctx.repo)) steps2.push(dispatch2.note);
     if (persisted) {
       await recordPhase(ledger, deps, anchors, "alignment", phaseEntry(alignmentPhaseEntry(devRollForward2, rcAlignment2)), { strict: true, landed: "the released, verified, deploy-resolved release (alignment PRs reused/landed)" });
@@ -22612,7 +22709,7 @@ ${recovery.note}`), recoveryInput);
   const announceNote = deps.announce ? (await deps.announce({ repo: ctx.repo, tag, summaryFile: options.announceSummaryFile })).note : void 0;
   const autoRunSince = (deps.now ?? Date.now)();
   const deployDispatch0 = await dispatchDeploy(deps, ctx, "main", "main", deployModel, watch, autoRunSince, tagSha, "report", meta.publishDir);
-  const deployDispatch = await recoverFailedDispatchPhase(
+  const recoveredDeployDispatch = await recoverFailedDispatchPhase(
     deps,
     ledger,
     anchors,
@@ -22625,6 +22722,7 @@ ${recovery.note}`), recoveryInput);
       workflow: isCentralDispatchModel(deployModel) ? "tenant-deploy.yml" : "deploy workflow"
     }
   );
+  const deployDispatch = await appendJervGatewayReleaseDeploy(deps, ctx.repo, tag, tagSha, recoveredDeployDispatch);
   steps.push(`dispatched the ${deployModel} deploy path`);
   await recordPhase(ledger, deps, anchors, "deploy", phaseEntry(deployPhaseInput(deployModel, deployDispatch, { releaseSha: tagSha })), {
     strict: ledgerMode === "strict",
@@ -22643,8 +22741,7 @@ ${recovery.note}`), recoveryInput);
     strict: ledgerMode === "strict",
     landed: "the immutable tag, the re-proven wall, origin/main, the verified GitHub Release, and the dispatched deploy path"
   });
-  let dispatch = appendPublishDispatch(deployDispatch, publishDispatch);
-  dispatch = await appendJervGatewayReleaseDeploy(deps, ctx.repo, tag, tagSha, dispatch);
+  const dispatch = appendPublishDispatch(deployDispatch, publishDispatch);
   const devRollForward = await rollDevelopmentForward(deps, ctx, tag);
   steps.push(`development roll-forward: ${devRollForward.status}`);
   const rcAlignment = !directTrack && branchHints.hasRcBranch ? await alignRcForward(deps, ctx, tag) : void 0;
@@ -25269,6 +25366,13 @@ function registerBoardCommands(program3) {
     const lane = holder.surface && holder.session && holder.host ? ` (${holder.surface}/${holder.session}@${holder.host})` : "";
     return `@${holder.login}${lane}`;
   }
+  function printClaimWarnings(warnings, toStderr = false) {
+    for (const warning of warnings ?? []) {
+      if (toStderr) process.stderr.write(`Warning: ${warning}
+`);
+      else console.log(`Warning: ${warning}`);
+    }
+  }
   function claimVerdict(ref, result) {
     const holder = formatClaimHolder(result.holder);
     const previousHolder = result.previousHolder ? formatClaimHolder(result.previousHolder) : "another lane";
@@ -25291,24 +25395,26 @@ function registerBoardCommands(program3) {
   const board = program3.command("board").description("read, claim, show, and move Project v2 work items for the current repo");
   board.command("read", { isDefault: true }).alias("list").description("read the board and print user-owned, claimable, and taken items").option("--json", "machine-readable output").option("--repo <owner/repo>", "current repo (defaults to git origin)").option("--direct", "bypass the Hub snapshot and read the live board through direct GitHub GraphQL").option("--bundle-details", "fetch body/comments only for user-owned and claimable issues").option("--bodies", "fetch body/comments for EVERY scoped row, including taken and unowned in-flight ones \u2014 for consumers that scope by Status rather than ownership (#4861); implies --bundle-details and costs one extra read per row").option("--allow-partial", "return partial board results when later page/detail reads fail").option("--out <path>", "write the output to this file as UTF-8 (no BOM) instead of stdout \u2014 the shell-free receipt path (#5802)").addHelpText("after", "\nread is always the authoritative live GitHub Project v2 board (#4926).\n--direct skips the Hub snapshot and uses the existing direct GitHub GraphQL read immediately.\n--allow-partial applies to the paginated path and detail reads.\n\nNever capture the JSON with a shell redirect on Windows: PowerShell 5.1's `> file.json` is Out-File,\nwhich writes UTF-16LE with a BOM, and Node reading it as 'utf8' then fails JSON.parse at position 1\n(#5802). Use --out instead \u2014 the CLI writes the file itself as UTF-8:\n  mmi-cli oracle board read --json --out .jerv/tmp/board.json\n").action((o) => runBoardRead(o));
   withExamples(mutating(
-    board.command("claim <issues...>").description("claim issues: assign them and move their Project v2 Status to In Progress \u2014 idempotent, so an item already yours and In Progress succeeds unchanged (one or more refs)").addHelpText("after", "\nevery claim stamps a lane-identity marker comment on the issue (`<!-- mmi-claim: \u2026 -->`,\nsurface/session@host) so other agents can attribute the hold (#3727). The session is the\nhost-exported id when the surface provides one, otherwise a per-process `synth-` fallback \u2014\na claim is never anonymous (#5245). `board show`, doctor and unclaim read the latest marker.\n\nsame-owner resume (#6035): when the prior marker was posted by YOUR login on THIS host and its\nlocal session is verifiably dead (transcript probe), the claim proceeds as a resume without\n--force and names the evidence. A live, foreign-host, or unprobeable prior lane still refuses.\n").option("--json", "machine-readable output").option("--repo <owner/repo>", "current repo for local issue numbers (defaults to git origin)").option("--for <login>", "assign to this login instead of @me \u2014 agent claims on behalf of the master").option("--force", "take an item already claimed by another lane that shows live evidence of active work (#3727)").option("--check", "read-only: run every claim gate and report the verdict, writing nothing \u2014 exits 1 with the same refusal a real claim would raise (#4511)").option("--allow-partial", "return success JSON if assignment succeeds but the status move fails"),
+    board.command("claim <issues...>").description("claim issues: assign them and move their Project v2 Status to In Progress \u2014 idempotent, so an item already yours and In Progress succeeds unchanged (one or more refs); the board scan rides the Hub snapshot, same as board read").addHelpText("after", "\nclaim reads the board through the same Hub snapshot leg as `board read` (the App-installation\ncredential, never your personal GraphQL pool); the direct user-auth read is an emergency fallback\nand is named in a Warning line after the verdict (#6162).\n\nevery claim stamps a lane-identity marker comment on the issue (`<!-- mmi-claim: \u2026 -->`,\nsurface/session@host) so other agents can attribute the hold (#3727). The session is the\nhost-exported id when the surface provides one, otherwise a per-process `synth-` fallback \u2014\na claim is never anonymous (#5245). `board show`, doctor and unclaim read the latest marker.\n\nsame-owner resume (#6035): when the prior marker was posted by YOUR login on THIS host and its\nlocal session is verifiably dead (transcript probe), the claim proceeds as a resume without\n--force and names the evidence. A live, foreign-host, or unprobeable prior lane still refuses.\n").option("--json", "machine-readable output").option("--repo <owner/repo>", "current repo for local issue numbers (defaults to git origin)").option("--for <login>", "assign to this login instead of @me \u2014 agent claims on behalf of the master").option("--force", "take an item already claimed by another lane that shows live evidence of active work (#3727)").option("--check", "read-only: run every claim gate and report the verdict, writing nothing \u2014 exits 1 with the same refusal a real claim would raise (#4511)").option("--allow-partial", "return success JSON if assignment succeeds but the status move fails"),
     (_opts, args) => ({ command: "board claim", issues: args[0] ?? [] })
   ).action(async (issueRefs, o) => {
     if (issueRefs.length === 1) {
       const issueRef = issueRefs[0];
       try {
+        const config = await loadConfigForBoardSelector2(issueRef, o.repo);
         const result = await claimBoardIssue({
-          config: await loadConfigForBoardSelector2(issueRef, o.repo),
+          config,
           selector: issueRef,
           repo: o.repo,
           assignee: o.for,
           force: o.force,
           check: o.check,
           allowPartial: o.allowPartial
-        });
+        }, { snapshot: registryClientDeps(config) });
         if (!result.checked) invalidateStatuslineBoardCache();
         if (o.json) return console.log(JSON.stringify(result));
         console.log(claimVerdict(result.item.ref, result));
+        printClaimWarnings(result.warnings);
       } catch (e) {
         if (refuseRateLimited(e, o.json)) return;
         return failGraceful(`board claim failed: ${e.message}`);
@@ -25316,22 +25422,25 @@ function registerBoardCommands(program3) {
       return;
     }
     try {
+      const config = await loadConfigForBoardSelector2(issueRefs[0], o.repo);
       const bulk = await claimBoardIssues({
-        config: await loadConfigForBoardSelector2(issueRefs[0], o.repo),
+        config,
         selectors: issueRefs,
         repo: o.repo,
         assignee: o.for,
         force: o.force,
         check: o.check,
         allowPartial: o.allowPartial
-      });
+      }, { snapshot: registryClientDeps(config) });
       if (bulk.results.some((r) => r.claimed && !r.checked)) invalidateStatuslineBoardCache();
       if (o.json) {
         console.log(JSON.stringify(bulk.results));
+        printClaimWarnings(bulk.warnings, true);
       } else {
         for (const result of bulk.results) {
           console.log(result.claimed ? claimVerdict(result.ref, result) : `Skipped ${result.ref}: ${result.reason}`);
         }
+        printClaimWarnings(bulk.warnings);
       }
       if (bulk.failed > 0) process.exitCode = 1;
     } catch (e) {
@@ -25505,7 +25614,7 @@ function registerBoardCommands(program3) {
 
 // src/bootstrap-commands.ts
 var import_node_fs26 = require("node:fs");
-var import_node_os13 = require("node:os");
+var import_node_os14 = require("node:os");
 var import_node_path25 = require("node:path");
 
 // src/command-plans.ts
@@ -25644,7 +25753,7 @@ function trainPlan(command, options = {}) {
     { label: "verify the fix is merged on development (the only hotfix origin)", gated: true },
     // #6068: hotfix start/release run the SAME shared preflight as release/rcand, before any git mutation.
     { label: "verify registry META for this project", command: "mmi-cli oracle org project get <owner/repo>", gated: true },
-    { label: "preflight required main secret names", command: "mmi-cli vault secrets preflight --stage main --repo <owner/repo>", gated: true },
+    { label: "preflight required main secret names", command: "mmi-cli vault secrets preflight --stage main --repo <owner/repo> --lane hotfix", gated: true },
     { label: "preflight local npm major vs the CI-declared npm, GitHub Actions hosted job start (billing/spending), and the gate wall-clock budget", command: "shared train preflight (#5666/#5604/#3178) \u2014 runs inside hotfix start and hotfix release", gated: true },
     { label: "refuse on a prior pending/failed train ledger leg (release, rcand or hotfix) before mutating anything", command: "shared release ledger (#5987/#6068) \u2014 finish that run first", gated: true },
     { label: "branch hotfix from main and cherry-pick the dev commits", command: "git cherry-pick -x <dev-sha>", gated: true },
@@ -27357,7 +27466,7 @@ function registerBootstrapCommands(program3) {
     const readFile9 = (p) => (0, import_node_fs26.existsSync)(p) ? (0, import_node_fs26.readFileSync)(p, "utf8") : null;
     const enc = (p) => p.split("/").map(encodeURIComponent).join("/");
     const putSeed = async (target, content, ref, sha) => {
-      const tmp = (0, import_node_path25.join)((0, import_node_os13.tmpdir)(), `mmi-seed-${process.pid}-${Date.now().toString(36)}-${Math.random().toString(36).slice(2)}.json`);
+      const tmp = (0, import_node_path25.join)((0, import_node_os14.tmpdir)(), `mmi-seed-${process.pid}-${Date.now().toString(36)}-${Math.random().toString(36).slice(2)}.json`);
       (0, import_node_fs26.writeFileSync)(tmp, JSON.stringify(contentPutBody(target, content, ref, sha)), "utf8");
       try {
         await gh(contentPutInputArgs(repo, target, tmp));
@@ -27956,7 +28065,7 @@ LIVE apply to ${repo}:
         } catch {
           existingSha = void 0;
         }
-        const tmp = (0, import_node_path25.join)((0, import_node_os13.tmpdir)(), `mmi-propagate-${process.pid}-${Date.now().toString(36)}-${Math.random().toString(36).slice(2)}.json`);
+        const tmp = (0, import_node_path25.join)((0, import_node_os14.tmpdir)(), `mmi-propagate-${process.pid}-${Date.now().toString(36)}-${Math.random().toString(36).slice(2)}.json`);
         const desiredContent = desiredByRepo.get(rec.repo);
         if (desiredContent == null) return fail(`bootstrap propagate: no resolved content for ${rec.repo} ${seed.target} \u2014 refusing to write`);
         (0, import_node_fs26.writeFileSync)(tmp, JSON.stringify(contentPutBody(seed.target, desiredContent, branch, existingSha)), "utf8");
@@ -28131,7 +28240,7 @@ Rollback: \`mmi-cli devops bootstrap rollback ${rec.repo} --target ${seed.target
       } catch {
         existingSha = void 0;
       }
-      const tmp = (0, import_node_path25.join)((0, import_node_os13.tmpdir)(), `mmi-rollback-${process.pid}-${Date.now().toString(36)}-${Math.random().toString(36).slice(2)}.json`);
+      const tmp = (0, import_node_path25.join)((0, import_node_os14.tmpdir)(), `mmi-rollback-${process.pid}-${Date.now().toString(36)}-${Math.random().toString(36).slice(2)}.json`);
       (0, import_node_fs26.writeFileSync)(tmp, JSON.stringify(contentPutBody(seed.target, preSeedContent, plan.branch, existingSha)), "utf8");
       try {
         await gh(contentPutInputArgs(repo, seed.target, tmp));
@@ -28252,7 +28361,7 @@ function formatDeployStatus(r) {
     `running version: ${r.runningVersion ?? "none stamped"}`,
     `last deploy run: ${formatLastRun(r)}`,
     `public URL: ${r.publicUrl ?? "none"}`,
-    `health probe: ${r.health ? `${r.health.ok ? "ok" : "failed"}${r.health.status ? ` (HTTP ${r.health.status})` : ""}${r.health.error ? ` \u2014 ${r.health.error}` : ""}` : "not probed"}`,
+    `health probe: ${r.health ? `${r.health.ok ? "ok" : "failed"}${r.health.status ? ` (HTTP ${r.health.status})` : ""}${r.health.error ? ` \u2014 ${r.health.error}` : ""}${r.health.url && r.health.url !== r.publicUrl ? ` at ${r.health.url}` : ""}` : "not probed"}`,
     `deploy state: ${r.deployOk === void 0 ? "not stamped" : r.deployOk ? "ok" : "failed"}`
   ];
   if (r.hints.length) {
@@ -28263,22 +28372,9 @@ function formatDeployStatus(r) {
 
 // src/deploy-commands.ts
 var STAGES2 = ["dev", "rc", "main"];
-async function probeHttpBounded(url, timeoutMs = 5e3) {
-  const controller = new AbortController();
-  const timeout = setTimeout(() => controller.abort(), timeoutMs);
-  timeout.unref?.();
-  try {
-    const res = await fetch(url, { method: "GET", signal: controller.signal });
-    return { ok: res.ok, status: res.status };
-  } catch (e) {
-    return { ok: false, error: e.message };
-  } finally {
-    clearTimeout(timeout);
-  }
-}
 function registerDeployCommands(program3) {
   const deploy = program3.command("deploy").description("per-stage deploy observability \u2014 last run, health, and running version (#2688)");
-  deploy.command("status <stage>").description("last deploy run + runtime health probe + running version for a stage (defaults to the current repo)").option("--repo <owner/repo>", "target repo (defaults to the current repo)").option("--json", "machine-readable output").action(async (stage, o) => {
+  deploy.command("status <stage>").description("last deploy run + runtime health probe + running version for a stage (defaults to the current repo); an auth-walled root (401/403) is re-probed at /health and the `url` field names the endpoint that answered (#6137)").option("--repo <owner/repo>", "target repo (defaults to the current repo)").option("--json", "machine-readable output").action(async (stage, o) => {
     if (!STAGES2.includes(stage)) {
       return fail(`runtime deploy status: <stage> must be dev, rc, or main`);
     }
@@ -28290,7 +28386,7 @@ function registerDeployCommands(program3) {
       const deployFacts = await fetchDeployFactsBySlug(slug, reg);
       const publicUrl = publicUrlFromDeployFact(deployFacts?.stages[stage] ?? null);
       const [health, lastRun] = await Promise.all([
-        publicUrl ? probeHttpBounded(publicUrl) : Promise.resolve(void 0),
+        publicUrl ? probePublicHealth(publicUrl) : Promise.resolve(void 0),
         fetchLastTenantDeployRun(slug, stage)
       ]);
       const report = buildDeployStatusReport({
@@ -29021,7 +29117,8 @@ function composeMarksRuntimeEnvTrue(composeText) {
     return false;
   });
 }
-function promotionSourceBranch(stage, releaseTrack) {
+function promotionSourceBranch(stage, releaseTrack, lane) {
+  if (lane === "hotfix") return "main";
   if (stage === "main") return releaseTrack === "direct" ? "development" : "rc";
   return "development";
 }
@@ -29887,7 +29984,7 @@ async function collectWaveStatus(deps) {
 
 // src/discovery-commands.ts
 var import_node_fs30 = require("node:fs");
-var import_node_os14 = require("node:os");
+var import_node_os15 = require("node:os");
 var import_node_path28 = require("node:path");
 var GC_GH_TIMEOUT_MS = 2e4;
 async function collectStatus() {
@@ -29922,7 +30019,7 @@ async function collectStatus() {
   try {
     const cfg = await loadConfigOrDiscover();
     if (cfg.sagaApiUrl) {
-      const report = await readBoard({ config: cfg });
+      const report = await readBoard({ config: cfg }, { snapshot: registryClientDeps(cfg) });
       claimedItems = report.primary.userOwned.map((item) => ({
         number: item.number,
         title: item.title,
@@ -29969,8 +30066,8 @@ var PRIORITY_RANK = {
 };
 async function recommendNext(repo, deps) {
   const load = deps?.loadConfig ?? loadConfigForRepo;
-  const reader = deps?.readBoard ?? readBoard;
   const cfg = await load(repo);
+  const reader = deps?.readBoard ?? ((opts) => readBoard(opts, { snapshot: registryClientDeps(cfg) }));
   if (!cfg.sagaApiUrl) throw new Error("Hub API URL not configured \u2014 the board was NOT read (run `mmi-cli doctor`)");
   let report;
   try {
@@ -30016,7 +30113,7 @@ async function collectOnboardStatus(opts = {}) {
   let board = { ok: false, detail: "no config" };
   try {
     if (cfg.sagaApiUrl) {
-      const report = await readBoard({ config: cfg });
+      const report = await readBoard({ config: cfg }, { snapshot: registryClientDeps(cfg) });
       const total = report.primary.claimable.length + report.primary.userOwned.length + report.primary.taken.length;
       board = { ok: true, detail: `board has ${total} active items (${report.primary.claimable.length} claimable, ${report.primary.userOwned.length} yours)` };
     } else {
@@ -30076,7 +30173,7 @@ async function collectOnboardStatus(opts = {}) {
     else if (top) nextCommand = `mmi-cli oracle board claim ${top.number}  # ${top.title}`;
     else nextCommand = "mmi-cli oracle board read \u2014 no claimable items found";
   }
-  const home = (0, import_node_os14.homedir)();
+  const home = (0, import_node_os15.homedir)();
   const plugin = onboardPluginGate({
     readKnown: () => readFileSyncSafe((0, import_node_path28.join)(home, ...KNOWN_MARKETPLACES_RELATIVE), import_node_fs30.readFileSync),
     readSettings: () => readFileSyncSafe((0, import_node_path28.join)(home, ".claude", "settings.json"), import_node_fs30.readFileSync)
@@ -32025,7 +32122,7 @@ var import_node_fs31 = require("node:fs");
 var import_node_crypto9 = require("node:crypto");
 
 // src/issue-body.ts
-var import_node_os15 = require("node:os");
+var import_node_os16 = require("node:os");
 var TextArgError = class extends Error {
   constructor(message2, code, offendingFlag) {
     super(message2);
@@ -32037,7 +32134,7 @@ var TextArgError = class extends Error {
   offendingFlag;
 };
 function emptyStdinMessage(fileFlag) {
-  if ((0, import_node_os15.platform)() === "win32") {
+  if ((0, import_node_os16.platform)() === "win32") {
     return `${fileFlag} - read empty stdin (on Windows, ${fileFlag} - is unreliable through the npm .cmd shim \u2014 use ${fileFlag} <path>, or pipe to \`node cli/dist/index.cjs\` directly)`;
   }
   return `${fileFlag} - read empty stdin (nothing piped \u2014 pass a heredoc/pipe, or ${fileFlag} <path>)`;
@@ -32577,6 +32674,10 @@ function validateBatchSpecs(specs) {
       spec.labels = [...spec.labels ?? [], ...alias];
       delete spec.label;
     }
+    if (spec.labels !== void 0 && (!Array.isArray(spec.labels) || spec.labels.some((l) => typeof l !== "string" || !l.trim()))) {
+      errors.push({ row, error: "labels must be an array of non-empty strings" });
+      continue;
+    }
     if (spec.repo !== void 0 && !/^[\w.-]+\/[\w.-]+$/.test(spec.repo)) {
       errors.push({ row, error: `bad repo "${spec.repo}" \u2014 expected owner/repo` });
       continue;
@@ -32585,13 +32686,17 @@ function validateBatchSpecs(specs) {
       errors.push({ row, error: `unknown type "${spec.type}" \u2014 expected one of: ${validTypes.join(", ")}` });
       continue;
     }
-    if (!spec.title || !spec.title.trim()) {
+    if (typeof spec.title !== "string" || !spec.title.trim()) {
       errors.push({ row, error: "missing or empty title" });
       continue;
     }
+    if (spec.body !== void 0 && typeof spec.body !== "string") {
+      errors.push({ row, error: "body must be a string" });
+      continue;
+    }
     let priority;
     try {
-      priority = spec.priority ? normalizePriority(spec.priority) : "medium";
+      priority = spec.priority ? normalizePriority(String(spec.priority)) : "medium";
     } catch (e) {
       errors.push({ row, error: e.message });
       continue;
@@ -32604,6 +32709,14 @@ function validateBatchSpecs(specs) {
       if (!labelsCarrySurface(spec.labels)) spec.labels = [...spec.labels ?? [], surfaceLabel(spec.surface)];
       delete spec.surface;
     }
+    if (spec.parent !== void 0) {
+      try {
+        parseIssueRef(spec.parent);
+      } catch (e) {
+        errors.push({ row, error: e.message });
+        continue;
+      }
+    }
     validated.push({ row, spec, priority, type: spec.type });
   }
   return { ok: errors.length === 0, errors, validated };
@@ -34030,6 +34143,8 @@ var UPDATE_PROJECT_INFO = `mutation($projectId: ID!, $shortDescription: String!,
     projectV2 { id }
   }
 }`;
+var ProjectInfoReadUnavailableError = class extends Error {
+};
 function shortDescriptionFromReadme(markdown) {
   const lines2 = markdown.replace(/\r/g, "").split("\n");
   const h1 = lines2.findIndex((line) => /^#\s+\S/.test(line.trim()));
@@ -34516,7 +34631,7 @@ function registerSchedulesCommands(program3) {
 // src/secrets-commands.ts
 var import_node_fs33 = require("node:fs");
 var import_node_path30 = require("node:path");
-var import_node_os16 = require("node:os");
+var import_node_os17 = require("node:os");
 
 // src/secrets-diff.ts
 var TIMEOUT_MS2 = 8e3;
@@ -34639,7 +34754,7 @@ async function decryptRailsCredentials(input) {
     'config = ActiveSupport::EncryptedConfiguration.new(config_path: config_path, key_path: key_path, env_key: "RAILS_MASTER_KEY", raise_if_missing_key: true)',
     "puts JSON.generate(config.config)"
   ].join("\n");
-  const scriptDir = (0, import_node_fs33.mkdtempSync)((0, import_node_path30.join)((0, import_node_os16.tmpdir)(), "mmi-rails-decrypt-"));
+  const scriptDir = (0, import_node_fs33.mkdtempSync)((0, import_node_path30.join)((0, import_node_os17.tmpdir)(), "mmi-rails-decrypt-"));
   const scriptPath = (0, import_node_path30.join)(scriptDir, "decrypt.rb");
   (0, import_node_fs33.writeFileSync)(scriptPath, script, "utf8");
   try {
@@ -34751,10 +34866,13 @@ function registerSecretsCommands(program3) {
     const ok = body !== void 0 ? await secretsOrgCatalogSet(d, body, { replace: o.replace, remove: o.remove }) : await secretsOrgCatalogRemove(d, o.remove ?? []);
     if (!ok) process.exitCode = 1;
   }));
-  secrets.command("preflight").description("check required stage secret names for a deploy/train without reading values").requiredOption("--stage <dev|rc|main>", "stage to check").option("--repo <owner/repo>", "target repo (defaults to the current repo)").option("--required <KEY...>", "required keys; bare keys are scoped under --stage").option("--skip-compose-guard", "skip the #2813 fileless-compose \u2194 DEPLOY#.noEnvFile promotion guard").option("--json", "machine-readable output").action(async (o) => {
+  secrets.command("preflight").description("check required stage secret names for a deploy/train without reading values").requiredOption("--stage <dev|rc|main>", "stage to check").option("--repo <owner/repo>", "target repo (defaults to the current repo)").option("--required <KEY...>", "required keys; bare keys are scoped under --stage").option("--skip-compose-guard", "skip the #2813 fileless-compose \u2194 DEPLOY#.noEnvFile promotion guard").option("--lane <hotfix>", "only hotfix is accepted: the hotfix lane deploys main, so the #2813 guard reads main, not rc (#6136); release/rcand need no flag").option("--json", "machine-readable output").action(async (o) => {
     if (!["dev", "rc", "main"].includes(o.stage)) {
       return fail("secrets preflight: --stage must be dev, rc, or main");
     }
+    if (o.lane !== void 0 && o.lane !== "hotfix") {
+      return fail("secrets preflight: --lane must be hotfix (the only lane that changes the compose source)");
+    }
     const cfg = await loadConfig();
     if (!cfg.sagaApiUrl) {
       fail("secrets: Hub API URL not configured");
@@ -34775,7 +34893,7 @@ function registerSecretsCommands(program3) {
     let filelessOk = true;
     if (meta && centralContainer && !o.skipComposeGuard) {
       const stage = o.stage;
-      const branch = promotionSourceBranch(stage, resolveReleaseTrack(meta, void 0, repo));
+      const branch = promotionSourceBranch(stage, resolveReleaseTrack(meta, void 0, repo), o.lane);
       const cwdRepo = repoFromRemoteUrl((await execFileP("git", ["remote", "get-url", "origin"]).catch(() => ({ stdout: "" }))).stdout);
       const { sameRepo: sameRepo2 } = resolvePreflightRepoScope(o.repo, cwdRepo);
       const facts = await fetchDeployFactsBySlug(slug, regDeps);
@@ -34981,10 +35099,11 @@ async function resolveBoardConfig2(repoOption) {
   const floor = await loadConfig();
   if (!floor.sagaApiUrl) return null;
   const slug = repoOption ? (repoOption.replace(/\.git$/, "").split("/").pop() ?? repoOption).toLowerCase() : await repoSlug();
-  const read = await fetchProjectBySlugChecked(slug, registryClientDeps(floor));
+  const registry2 = registryClientDeps(floor);
+  const read = await fetchProjectBySlugChecked(slug, registry2);
   if (!read.ok || !read.project) return null;
   const cfg = boardConfigFromProject(read.project, floor);
-  return readBoard({ config: cfg, repo: repoOption, allowPartial: true });
+  return readBoard({ config: cfg, repo: repoOption, allowPartial: true }, { snapshot: registry2 });
 }
 function registerSessionReport(program3) {
   const report = program3.commands.find((c) => c.name() === "report");
@@ -35926,7 +36045,7 @@ async function runPrLand(prNumber, options, deps) {
 // src/merge-cleanup.ts
 var import_node_fs37 = require("node:fs");
 var import_node_path34 = require("node:path");
-var import_node_os17 = require("node:os");
+var import_node_os18 = require("node:os");
 
 // src/board-advance.ts
 function repoOf2(ref) {
@@ -36753,24 +36872,31 @@ function runTestPolicy(root, deps = {}) {
 ` + (deps.base === HOTFIX_DIFF_BASE ? `  Hotfix lane (--base ${HOTFIX_DIFF_BASE}): pass --policy-ref <exact-${HOTFIX_POLICY_REF}-commit> so the current policy is read from ${HOTFIX_POLICY_REF}.` : `  Restore ${POLICY_FILE} on this branch; the policy file belongs on every non-hotfix lane.`)
   }] : [];
   const present = (path2) => exists((0, import_node_path33.join)(root, path2));
+  const policyTree = policySource.sha ? new Set(git2(["ls-tree", "-r", "-z", "--name-only", policySource.sha], root).split("\0").filter(Boolean).map((p) => (0, import_node_path33.join)(root, p))) : null;
+  const policyTreeExists = policyTree ? (abs) => policyTree.has(abs) : exists;
+  const where = policySource.sha ? `${policySource.ref}@${policySource.sha}` : "this worktree";
   const removedByThisDiff = removedPaths(changed);
   const staleFindings = [];
-  const unresolved = unresolvedProtectedEntries(policy, root, exists).filter((p) => !removedByThisDiff.has(p));
+  const unresolved = unresolvedProtectedEntries(policy, root, policyTreeExists).filter((p) => !removedByThisDiff.has(p));
   if (unresolved.length > 0) {
     staleFindings.push({
       kind: "stale-protected-entry",
       paths: unresolved,
-      detail: `STALE PROTECTED ENTRY \u2014 test-policy.json protects ${unresolved.length} path(s) that do not exist:
-` + unresolved.map((p) => `    ${p}`).join("\n") + "\n  An entry naming a missing file reads as protection while protecting nothing.\n  Restore the file, or remove its entry."
+      detail: `STALE PROTECTED ENTRY \u2014 test-policy.json protects ${unresolved.length} path(s) that do not exist on ${where}:
+` + unresolved.map((p) => `    ${p}`).join("\n") + `
+  An entry naming a missing file reads as protection while protecting nothing.
+  Restore the file on ${where}, or remove its entry.`
     });
   }
-  const staleSatisfiers = unresolvedSatisfiers(policy, root, exists).filter((p) => !removedByThisDiff.has(p));
+  const staleSatisfiers = unresolvedSatisfiers(policy, root, policyTreeExists).filter((p) => !removedByThisDiff.has(p));
   if (staleSatisfiers.length > 0) {
     staleFindings.push({
       kind: "stale-satisfied-by",
       paths: staleSatisfiers,
-      detail: `STALE STANDING COVERAGE \u2014 a mandatory glob claims ${staleSatisfiers.length} path(s) as satisfiedBy that do not exist:
-` + staleSatisfiers.map((p) => `    ${p}`).join("\n") + "\n  A glob discharged by coverage that is not there is a glob enforcing nothing, quietly.\n  Restore the file, or drop it from satisfiedBy so the glob asks for a test again."
+      detail: `STALE STANDING COVERAGE \u2014 a mandatory glob claims ${staleSatisfiers.length} path(s) as satisfiedBy that do not exist on ${where}:
+` + staleSatisfiers.map((p) => `    ${p}`).join("\n") + `
+  A glob discharged by coverage that is not there is a glob enforcing nothing, quietly.
+  Restore the file on ${where}, or drop it from satisfiedBy so the glob asks for a test again.`
     });
   }
   const override = lookup.override;
@@ -36957,7 +37083,7 @@ function resolveSquashMergeBodyText(commits, allowedClosing, cwd) {
   return rewritten === base ? null : rewritten;
 }
 function writeSquashBodyFile(body) {
-  const dir = (0, import_node_fs37.mkdtempSync)((0, import_node_path34.join)((0, import_node_os17.tmpdir)(), "mmi-squash-body-"));
+  const dir = (0, import_node_fs37.mkdtempSync)((0, import_node_path34.join)((0, import_node_os18.tmpdir)(), "mmi-squash-body-"));
   const path2 = (0, import_node_path34.join)(dir, "body.txt");
   (0, import_node_fs37.writeFileSync)(path2, body.endsWith("\n") ? body : `${body}
 `, "utf8");
@@ -37085,15 +37211,17 @@ function cleanupGitArgs(cwd, args) {
 }
 async function remoteBranchExists2(branch, options = {}) {
   if (!branch) return void 0;
+  const remote = options.remote ?? "origin";
   try {
-    if (options.prune) await execFileP("git", cleanupGitArgs(options.cwd, ["fetch", "origin", "--prune"]), { timeout: GIT_TIMEOUT_MS });
-    return (await execFileP("git", cleanupGitArgs(options.cwd, ["ls-remote", "--heads", "origin", branch]), { timeout: GIT_TIMEOUT_MS })).stdout.trim().length > 0;
+    if (options.prune) await execFileP("git", cleanupGitArgs(options.cwd, ["fetch", remote, "--prune"]), { timeout: GIT_TIMEOUT_MS });
+    return (await execFileP("git", cleanupGitArgs(options.cwd, ["ls-remote", "--heads", remote, branch]), { timeout: GIT_TIMEOUT_MS })).stdout.trim().length > 0;
   } catch {
     return void 0;
   }
 }
 async function deleteMergedRemoteBranch(options) {
-  const remediation = `git push origin --delete ${options.branch}`;
+  const remote = options.remote ?? "origin";
+  const remediation = `git push ${remote} --delete ${options.branch}`;
   if (!options.branch) {
     return {
       branch: options.branch,
@@ -37122,13 +37250,13 @@ async function deleteMergedRemoteBranch(options) {
         existedBefore: false,
         attempted: false,
         status: "failed",
-        error: `could not verify absence of origin/${options.branch}`,
+        error: `could not verify absence of ${remote}/${options.branch}`,
         remediation
       };
     }
   }
   try {
-    await options.execGit(["push", "origin", "--delete", options.branch]);
+    await options.execGit(["push", remote, "--delete", options.branch]);
   } catch (e) {
     const exists2 = await options.branchExists(options.branch);
     if (exists2 === false) {
@@ -37162,7 +37290,7 @@ async function deleteMergedRemoteBranch(options) {
     existedBefore: options.existedBefore,
     attempted: true,
     status: "failed",
-    error: exists ? `origin still reports ${options.branch} after deletion` : `could not verify deletion of origin/${options.branch}`,
+    error: exists ? `${remote} still reports ${options.branch} after deletion` : `could not verify deletion of ${remote}/${options.branch}`,
     remediation
   };
 }
@@ -37504,11 +37632,13 @@ async function prCreateClaimRefusal(body, repoOption, deps = {}) {
   const actor = deps.actor ?? describeSessionIdentity();
   const checkContest = deps.checkContest ?? checkLaneContest;
   for (const number of issues) {
+    const state = await client.rest("GET", `repos/${repo}/issues/${number}`).then((issue) => issue?.state, () => void 0);
+    if (state?.toLowerCase() === "closed") continue;
     const contest = await checkContest(client, { repository: repo, number }, actor);
     if (!contest.contested) continue;
     const ref = `${repo}#${number}`;
     const holder = contest.marker ? `lane ${describeClaimMarker(contest.marker)}` : "another lane";
-    return `pr create: REFUSED \u2014 ${ref} is held by ${holder} with live or unreadable work evidence; run \`mmi-cli oracle board claim ${ref} --force\` before creating this PR`;
+    return `pr create: REFUSED \u2014 ${ref} is held by ${holder} with live or unreadable work evidence; run \`mmi-cli oracle board claim ${ref} --force\` (move it to In Progress first if it sits In Review) or drop the closing line before creating this PR`;
   }
   return void 0;
 }
@@ -37519,13 +37649,13 @@ var import_node_path38 = require("node:path");
 
 // src/jervcode-node-modules-cleanup.ts
 var import_node_fs39 = require("node:fs");
-var import_node_os18 = require("node:os");
+var import_node_os19 = require("node:os");
 var import_node_path36 = require("node:path");
 var JERVCODE_PACKAGE_ENTRY = (0, import_node_path36.join)("node_modules", "@jervaise", "jervcode", "dist", "launcher-entry.js");
 var WIN_NAMES2 = ["jervcode.cmd", "jervcode"];
 var POSIX_NAMES2 = ["jervcode"];
 var NODE_MODULES_CLEANUP_TIMEOUT_MS = 3e5;
-function jervcodeCandidatePaths(env = process.env, home = (0, import_node_os18.homedir)(), platform2 = process.platform) {
+function jervcodeCandidatePaths(env = process.env, home = (0, import_node_os19.homedir)(), platform2 = process.platform) {
   const names = platform2 === "win32" ? WIN_NAMES2 : POSIX_NAMES2;
   const out = [];
   for (const dir of jervCliCandidateDirs(env, home, platform2)) {
@@ -37533,7 +37663,7 @@ function jervcodeCandidatePaths(env = process.env, home = (0, import_node_os18.h
   }
   return out;
 }
-function resolveJervcodePath(env = process.env, home = (0, import_node_os18.homedir)(), platform2 = process.platform, exists = import_node_fs39.existsSync) {
+function resolveJervcodePath(env = process.env, home = (0, import_node_os19.homedir)(), platform2 = process.platform, exists = import_node_fs39.existsSync) {
   for (const candidate of jervcodeCandidatePaths(env, home, platform2)) {
     if (exists(candidate)) return candidate;
   }
@@ -37542,7 +37672,7 @@ function resolveJervcodePath(env = process.env, home = (0, import_node_os18.home
 function jervcodeExecFileArgs(args, opts = {}) {
   const platform2 = opts.platform ?? process.platform;
   const exists = opts.exists ?? import_node_fs39.existsSync;
-  const resolved = resolveJervcodePath(opts.env ?? process.env, opts.home ?? (0, import_node_os18.homedir)(), platform2, exists);
+  const resolved = resolveJervcodePath(opts.env ?? process.env, opts.home ?? (0, import_node_os19.homedir)(), platform2, exists);
   if (resolved) {
     const entry = (0, import_node_path36.join)((0, import_node_path36.join)(resolved, ".."), JERVCODE_PACKAGE_ENTRY);
     if (exists(entry)) {
@@ -37908,6 +38038,69 @@ function safeRemoveTree(path2) {
   }
   (0, import_node_fs41.unlinkSync)(path2);
 }
+function errorMessage(e) {
+  return e instanceof Error ? e.message : String(e);
+}
+function resolvedOrRaw(path2) {
+  try {
+    return normPath2((0, import_node_fs41.realpathSync)(path2));
+  } catch {
+    return normPath2(path2);
+  }
+}
+function unlinkEscapingReparsePoints(root, primaryRoot) {
+  let realRoot;
+  try {
+    if ((0, import_node_fs41.lstatSync)(root).isSymbolicLink()) {
+      return { ok: false, error: `delete root ${normPath2(root)} is a reparse point resolving to ${resolvedOrRaw(root)}` };
+    }
+    realRoot = normPath2((0, import_node_fs41.realpathSync)(root));
+  } catch (e) {
+    if (e.code === "ENOENT") return { ok: true, unlinked: [] };
+    return { ok: false, error: `cannot resolve delete root ${normPath2(root)}: ${errorMessage(e)}` };
+  }
+  const realPrimary = resolvedOrRaw(primaryRoot);
+  const forbidden = isPathAtOrWithin(realPrimary, realRoot) ? realPrimary : [`${realPrimary}/node_modules`, `${realPrimary}/packages`].find((p) => isPathAtOrWithin(realRoot, p));
+  if (forbidden) {
+    return { ok: false, error: `delete root ${normPath2(root)} (resolved ${realRoot}) is or contains the primary checkout path ${forbidden}` };
+  }
+  const unlinked = [];
+  const stack = [realRoot];
+  while (stack.length) {
+    const dir = stack.pop();
+    let entries;
+    try {
+      entries = (0, import_node_fs41.readdirSync)(dir, { withFileTypes: true });
+    } catch (e) {
+      return { ok: false, error: `cannot scan ${normPath2(dir)} for reparse points: ${errorMessage(e)}` };
+    }
+    for (const entry of entries) {
+      const child2 = (0, import_node_path38.join)(dir, entry.name);
+      if (entry.isSymbolicLink()) {
+        let target = "";
+        try {
+          target = normPath2((0, import_node_fs41.realpathSync)(child2));
+        } catch {
+          target = "";
+        }
+        if (target && isPathAtOrWithin(target, realRoot)) continue;
+        try {
+          safeRemoveTree(child2);
+        } catch (e) {
+          return { ok: false, error: `cannot unlink reparse point ${normPath2(child2)} -> ${target || "unresolvable"}: ${errorMessage(e)}` };
+        }
+        unlinked.push(normPath2(child2));
+        continue;
+      }
+      if (entry.isDirectory()) stack.push(child2);
+    }
+  }
+  return { ok: true, unlinked };
+}
+function reparseEscapeRemediation(wtPath) {
+  const quote = (value) => value.replace(/'/g, "''");
+  return `inspect '${quote(wtPath)}' manually \u2014 a reparse point resolves outside the worktree; never remove it recursively`;
+}
 async function describePreCleanFailure(wtPath, execGit, error) {
   const dryRun = await execGit(["-C", wtPath, "clean", "-ndX"]).catch(() => "");
   const remaining = dryRun.split(/\r?\n/).map((line) => line.trim()).filter((line) => line.startsWith("Would remove ")).map((line) => line.slice("Would remove ".length));
@@ -37942,6 +38135,25 @@ async function verifyBranchHead(git3, branch, expectedHeadOid) {
   }
   return { ok: true };
 }
+async function switchPrimaryCheckoutOffMergedBranch(wtPath, branch, baseRef, execGit, expectedHeadOid) {
+  const git3 = (args) => execGit(["-C", wtPath, ...args]);
+  const headCheck = await verifyBranchHead(git3, branch, expectedHeadOid);
+  if (!headCheck.ok) return { ok: false, error: headCheck.error ? `${headCheck.reason}: ${headCheck.error}` : headCheck.reason };
+  const porcelain = await git3(["status", "--porcelain"]).catch(() => void 0);
+  if (porcelain === void 0) return { ok: false, error: "could not read the primary checkout status" };
+  if (porcelainHasBlockingChanges(porcelain)) return { ok: false, error: "dirty-worktree" };
+  try {
+    await git3(["switch", baseRef]);
+  } catch (e) {
+    return { ok: false, error: `switch to ${baseRef} failed: ${formatGitCommandError(e)}` };
+  }
+  try {
+    await git3(["branch", "-D", branch]);
+  } catch (e) {
+    return { ok: false, switchedTo: baseRef, error: `branch -D ${branch} failed after switching to ${baseRef}: ${formatGitCommandError(e)}` };
+  }
+  return { ok: true, switchedTo: baseRef };
+}
 async function teardownWorktreeStage(worktreePath) {
   try {
     const result = await stopStage({ cwd: worktreePath, requiredIdentityCwd: worktreePath, globalStatePath: false });
@@ -38035,7 +38247,7 @@ async function removeWorktreeWithReconcile(wtPath, git3, listWorktrees, pathExis
 }
 function isPrMergeWorktreePartial(cleanup) {
   const worktree = cleanup?.worktree;
-  return Boolean(worktree?.path && worktree.status !== "removed" && worktree.status !== "preserved" && worktree.status !== "retained-locked");
+  return Boolean(worktree?.path && worktree.status !== "removed" && worktree.status !== "preserved" && worktree.status !== "retained-locked" && worktree.status !== "switched-primary");
 }
 function prMergeLocalCleanupExitCode(cleanup) {
   return cleanup?.worktree?.status === "failed" || cleanup?.localBranch?.status === "failed" ? 1 : void 0;
@@ -38075,10 +38287,29 @@ async function cleanupPrMergeLocalBranch(branch, options) {
   const mainWorktreeTarget = Boolean(wtPath && mainWorktreePath && samePath(wtPath, mainWorktreePath));
   if (!wtPath || mainWorktreeTarget) {
     if (wtPath && mainWorktreeTarget) {
+      const switched = await switchPrimaryCheckoutOffMergedBranch(wtPath, branch, options.baseRef, execGit, options.expectedHeadOid);
+      if (switched.ok) {
+        report.worktree = { path: wtPath, status: "switched-primary", reason: "main-worktree", switchedTo: switched.switchedTo };
+        report.localBranch = { name: branch, status: "deleted" };
+        return report;
+      }
+      if (switched.switchedTo) {
+        report.worktree = {
+          path: wtPath,
+          status: "switched-primary",
+          reason: "main-worktree",
+          switchedTo: switched.switchedTo,
+          error: switched.error,
+          remediation: primaryCheckoutBranchRemediation(options.primaryRoot, options.baseRef, branch)
+        };
+        report.localBranch = { name: branch, status: "failed", error: switched.error };
+        return report;
+      }
       report.worktree = {
         path: wtPath,
         status: "not-attempted",
         reason: "main-worktree",
+        error: switched.error,
         remediation: primaryCheckoutBranchRemediation(options.primaryRoot, options.baseRef, branch)
       };
     }
@@ -38098,7 +38329,12 @@ async function cleanupPrMergeLocalBranch(branch, options) {
     return report;
   }
   const porcelain = await execGit(["-C", wtPath, "status", "--porcelain"]).catch(() => void 0);
-  if (porcelain?.trim()) {
+  if (porcelain === void 0) {
+    report.worktree = { path: wtPath, status: "refused", reason: "status-unreadable", error: "could not read the worktree status" };
+    report.localBranch = { name: branch, status: "not-attempted", reason: "status-unreadable" };
+    return report;
+  }
+  if (porcelain.trim()) {
     report.worktree = { path: wtPath, status: "refused", reason: "dirty-worktree" };
     report.localBranch = { name: branch, status: "not-attempted", reason: "dirty-worktree" };
     return report;
@@ -38148,6 +38384,25 @@ async function cleanupPrMergeLocalBranch(branch, options) {
     report.localBranch = { name: branch, status: "not-attempted", reason: "archive-failed" };
     return report;
   }
+  const unlinkedReparsePoints = [];
+  const refuseReparseEscape = (error) => {
+    report.worktree = {
+      path: wtPath,
+      status: "refused",
+      reason: "reparse-escape",
+      error,
+      artifactsArchive,
+      stageTeardown,
+      tmpEvidenceCount: tmpEvidence.length,
+      ...unlinkedReparsePoints.length ? { unlinkedReparsePoints } : {},
+      remediation: reparseEscapeRemediation(wtPath)
+    };
+    report.localBranch = { name: branch, status: "not-attempted", reason: "reparse-escape" };
+    return report;
+  };
+  const preHelperGuard = unlinkEscapingReparsePoints(wtPath, options.primaryRoot);
+  if (!preHelperGuard.ok) return refuseReparseEscape(preHelperGuard.error);
+  unlinkedReparsePoints.push(...preHelperGuard.unlinked);
   if (pathExists((0, import_node_path38.join)(wtPath, "node_modules"))) {
     const nmRemoved = await (options.removeRealNodeModules ?? ((p) => removeWorktreeNodeModulesViaHelper(p, { cwd: mainWorktreePath })))(wtPath);
     if (!nmRemoved.ok) {
@@ -38159,6 +38414,7 @@ async function cleanupPrMergeLocalBranch(branch, options) {
         artifactsArchive,
         stageTeardown,
         tmpEvidenceCount: tmpEvidence.length,
+        ...unlinkedReparsePoints.length ? { unlinkedReparsePoints } : {},
         remediation: `jervcode worktree-node-modules-cleanup --worktree '${wtPath.replace(/'/g, "''")}'`
       };
       report.localBranch = { name: branch, status: "not-attempted", reason: "worktree-pre-clean-failed" };
@@ -38175,12 +38431,16 @@ async function cleanupPrMergeLocalBranch(branch, options) {
       artifactsArchive,
       stageTeardown,
       tmpEvidenceCount: tmpEvidence.length,
+      ...unlinkedReparsePoints.length ? { unlinkedReparsePoints } : {},
       // #6076: name the surviving node_modules remover when the dry run found one, else the clean.
       remediation: preClean.remediation ?? `git -C '${wtPath.replace(/'/g, "''")}' clean -ffdX`
     };
     report.localBranch = { name: branch, status: "not-attempted", reason: "worktree-pre-clean-failed" };
     return report;
   }
+  const preRemoveGuard = unlinkEscapingReparsePoints(wtPath, options.primaryRoot);
+  if (!preRemoveGuard.ok) return refuseReparseEscape(preRemoveGuard.error);
+  unlinkedReparsePoints.push(...preRemoveGuard.unlinked);
   moveCwdToSafeWorktree(wtPath, safeCwd);
   const removal = await removeWorktreeWithReconcile(
     wtPath,
@@ -38195,7 +38455,8 @@ async function cleanupPrMergeLocalBranch(branch, options) {
       error: removal.error,
       artifactsArchive,
       stageTeardown,
-      tmpEvidenceCount: tmpEvidence.length
+      tmpEvidenceCount: tmpEvidence.length,
+      ...unlinkedReparsePoints.length ? { unlinkedReparsePoints } : {}
     };
     report.localBranch = { name: branch, status: "not-attempted", reason: "worktree-removal-failed" };
     return report;
@@ -38206,7 +38467,8 @@ async function cleanupPrMergeLocalBranch(branch, options) {
     ...removal.reason ? { reason: removal.reason } : {},
     artifactsArchive,
     stageTeardown,
-    tmpEvidenceCount: tmpEvidence.length
+    tmpEvidenceCount: tmpEvidence.length,
+    ...unlinkedReparsePoints.length ? { unlinkedReparsePoints } : {}
   };
   if (pathExists(wtPath)) {
     const residue = await (options.removeResidueDir?.(wtPath) ?? removeResidueDirectory(wtPath));
@@ -38254,12 +38516,18 @@ function renderPrMergeCleanupLines(cleanup) {
     lines2.push(`pr merge: preserved worktree ${wt.path} (--preserve-worktree)`);
   } else if (wt.status === "retained-locked") {
     lines2.push(`pr merge: worktree ${wt.path} cleanup deferred \u2014 its Windows parent shell still holds the cwd; ${wt.remediation ?? "exit the shell and remove the residue from the primary checkout"}`);
+  } else if (wt.status === "switched-primary") {
+    const now = wt.switchedTo ? `to ${wt.switchedTo}` : "to the base branch";
+    lines2.push(wt.error ? `pr merge: primary checkout ${wt.path} switched ${now} but deleting the merged branch failed \u2014 ${wt.error}; remediate: ${wt.remediation ?? "delete the merged branch manually"}` : `pr merge: primary checkout ${wt.path} held the merged branch \u2014 switched it back ${now} and deleted the branch`);
   } else if (wt.status === "not-attempted" && wt.reason === "main-worktree") {
-    lines2.push(`pr merge: merged branch is still checked out in the primary checkout ${wt.path} \u2014 not removed; remediate: ${wt.remediation ?? "switch it back to the base branch and delete the merged branch"}`);
+    lines2.push(`pr merge: merged branch is still checked out in the primary checkout ${wt.path} \u2014 not removed${wt.error ? ` (${wt.error})` : ""}; remediate: ${wt.remediation ?? "switch it back to the base branch and delete the merged branch"}`);
   }
   if (wt.residue === "left" && wt.status !== "retained-locked") {
     lines2.push(`pr merge: worktree ${wt.path} registration is gone but residue remains \u2014 ${wt.residueError ?? wt.path}; remediate: ${wt.remediation ?? wt.path}`);
   }
+  if (wt.unlinkedReparsePoints?.length) {
+    lines2.push(`pr merge: unlinked ${wt.unlinkedReparsePoints.length} reparse point(s) resolving outside ${wt.path}: ${wt.unlinkedReparsePoints.join(", ")}`);
+  }
   if (wt.artifactsArchive?.status === "archived" && wt.artifactsArchive.path) {
     lines2.push(`pr merge: archived worktree evidence to ${wt.artifactsArchive.path}`);
   } else if (wt.artifactsArchive?.status === "blocked" && wt.artifactsArchive.error) {
@@ -39321,7 +39589,7 @@ ${list}`);
     else printLine(`pr land: ${result.status}${result.error ? ` \u2014 ${result.error}` : ""}`);
     if (result.status === "failed") process.exitCode = 1;
   });
-  jsonParity(pr.command("merge <number>").description("merge a PR (squash by default); archives gitignored tmp/** before worktree teardown; on no-ci repos run pr ci-policy / checks-wait first (#1432, #5679)").option("--squash", "squash merge (default)").option("--merge", "create a merge commit").option("--rebase", "rebase merge").option("--repo <owner/repo>", "target repo (defaults to the current repo)").option("--auto", "enable auto-merge \u2014 merge once the base-branch policy is satisfied (use for policy-gated repos)").addOption(new Option("--disable-auto", "disable a queued auto-merge without merging").conflicts(["auto", "wait", "squash", "merge", "rebase", "preserveWorktree", "gc", "squashBodyFile", "force"])).option("--wait", `wait for checks to reach a terminal passing verdict before merging (default budget ${PR_CHECKS_TIMEOUT_MS / 6e4}m) \u2014 run as a background/monitor task or under a shell timeout above that budget; a short foreground timeout (e.g. 120s) kills it after checks pass and leaves the PR open (#6027)`).option("--preserve-worktree", "after merge, keep the local PR worktree/branch for an active batch (#1888)").option("--gc", "acknowledge deleting unarchived gitignored tmp/** evidence newer than the branch base (#5679)").option("--squash-body-file <path>", "squash commit body (overrides GitHub COMMIT_MESSAGES); use when a pushed commit mentions close/fix/resolve + #N that must not close (#5723)").option("--force", "acknowledge and merge past a remaining prunable/severe scratch housekeeping block (advisory kept plans/ never blocks, #3012) or a negated-closing-keyword (#3718) or ambiguous-cross-repo-closing (#4279) refusal")).action(async (number, o) => {
+  jsonParity(pr.command("merge <number>").description("merge a PR (squash by default); archives gitignored tmp/** before worktree teardown; on no-ci repos run pr ci-policy / checks-wait first (#1432, #5679)").option("--squash", "squash merge (default)").option("--merge", "create a merge commit").option("--rebase", "rebase merge").option("--repo <owner/repo>", "target repo (defaults to the current repo); from a foreign checkout the remote probe/delete address this repo and local cleanup runs only in the verified sibling checkout ../<repo>, else localBranch reports skipped-foreign-cwd and the receipt carries foreignCwd: true (#6148)").option("--auto", "enable auto-merge \u2014 merge once the base-branch policy is satisfied (use for policy-gated repos)").addOption(new Option("--disable-auto", "disable a queued auto-merge without merging").conflicts(["auto", "wait", "squash", "merge", "rebase", "preserveWorktree", "gc", "squashBodyFile", "force"])).option("--wait", `wait for checks to reach a terminal passing verdict before merging (default budget ${PR_CHECKS_TIMEOUT_MS / 6e4}m) \u2014 run as a background/monitor task or under a shell timeout above that budget; a short foreground timeout (e.g. 120s) kills it after checks pass and leaves the PR open (#6027)`).option("--preserve-worktree", "after merge, keep the local PR worktree/branch for an active batch (#1888)").option("--gc", "acknowledge deleting unarchived gitignored tmp/** evidence newer than the branch base (#5679)").option("--squash-body-file <path>", "squash commit body (overrides GitHub COMMIT_MESSAGES); use when a pushed commit mentions close/fix/resolve + #N that must not close (#5723)").option("--force", "acknowledge and merge past a remaining prunable/severe scratch housekeeping block (advisory kept plans/ never blocks, #3012) or a negated-closing-keyword (#3718) or ambiguous-cross-repo-closing (#4279) refusal")).action(async (number, o) => {
     const method = o.rebase ? "--rebase" : o.merge ? "--merge" : "--squash";
     const repoArgs = o.repo ? ["--repo", o.repo] : [];
     if (o.disableAuto) {
@@ -39381,7 +39649,23 @@ ${list}`);
     const startingPath = (await execFileP("git", ["rev-parse", "--show-toplevel"], { timeout: GIT_TIMEOUT_MS }).catch(() => ({ stdout: "" }))).stdout.trim();
     const housekeeping = assertPrMergeHousekeepingClean(startingPath || process.cwd(), "pr merge", { force: o.force });
     const beforeWorktreesRead = await execFileP("git", ["worktree", "list", "--porcelain"], { timeout: GIT_TIMEOUT_MS }).then((r) => ({ state: "ok", stdout: r.stdout })).catch((e) => ({ state: "failed", error: e.message || "git worktree list failed" }));
-    const beforeWorktrees = beforeWorktreesRead.state === "ok" ? parseGitWorktreePorcelain(beforeWorktreesRead.stdout) : [];
+    let beforeWorktrees = beforeWorktreesRead.state === "ok" ? parseGitWorktreePorcelain(beforeWorktreesRead.stdout) : [];
+    const cwdRepo = repoFromRemoteUrl(await gitOut(["remote", "get-url", "origin"]).catch(() => ""));
+    const targetRepo2 = repoForPostCleanup ? repoForPostCleanup.split("/").slice(-2).join("/") : void 0;
+    const foreignCwd = Boolean(o.repo) && Boolean(targetRepo2) && cwdRepo?.toLowerCase() !== targetRepo2.toLowerCase();
+    const remote = foreignCwd ? `https://github.com/${targetRepo2}.git` : "origin";
+    let foreignCheckout;
+    if (foreignCwd) {
+      const sibling = (0, import_node_path39.join)((0, import_node_path39.dirname)(beforeWorktrees[0]?.path || startingPath || process.cwd()), targetRepo2.split("/")[1]);
+      const siblingRepo = repoFromRemoteUrl(await gitOut(["-C", sibling, "remote", "get-url", "origin"]).catch(() => ""));
+      if (siblingRepo?.toLowerCase() === targetRepo2.toLowerCase()) {
+        const siblingWorktrees = await execFileP("git", ["-C", sibling, "worktree", "list", "--porcelain"], { timeout: GIT_TIMEOUT_MS }).then((r) => parseGitWorktreePorcelain(r.stdout)).catch(() => void 0);
+        if (siblingWorktrees?.length) {
+          foreignCheckout = sibling;
+          beforeWorktrees = siblingWorktrees;
+        }
+      }
+    }
     const ciHeadRef = repoForPostCleanup ? await prHeadRefForCiProbe(number, repoForPostCleanup) : void 0;
     const ciPolicy = await resolveMergeCiPolicyForCheckout(o.repo, ciHeadRef);
     if (o.wait) {
@@ -39439,7 +39723,7 @@ ${list}`);
       if (guard.action === "refuse") throw new Error(`gh pr merge ${number}: ${guard.message}`);
       if (guard.note) console.warn(`pr merge: ${guard.note}`);
     }
-    const remoteBefore = await remoteBranchExists2(headRef);
+    const remoteBefore = await remoteBranchExists2(headRef, { remote });
     let upgradedToAuto = false;
     let remoteNotAttemptedReason = "preserved-delayed-cleanup";
     const overrideBody = mergeSquashBody ? { ...writeSquashBodyFile(mergeSquashBody), text: mergeSquashBody } : await composeOverrideBodyFile(
@@ -39558,30 +39842,34 @@ ${list}`);
     }
     const primaryRoot = beforeWorktrees[0]?.path ?? (startingPath || process.cwd());
     let localCleanup;
-    try {
-      localCleanup = await cleanupPrMergeLocalBranch(headRef, {
-        beforeWorktrees,
-        startingPath,
-        baseRef,
-        primaryRoot,
-        preserveWorktree: o.preserveWorktree,
-        gcAcknowledged: o.gc,
-        expectedHeadOid: headRefOid,
-        pathExists: (p) => (0, import_node_fs42.existsSync)(p),
-        // #5899: pin cleanup git calls to the main checkout — the task worktree this process may be
-        // standing in is removed mid-cleanup, so a cwd-relative invocation fails with
-        // 'fatal: not a git repository' and leaves a spurious partial-cleanup exit.
-        execGit: async (args) => (await execFileP("git", cleanupGitArgs(primaryRoot, args), { timeout: GIT_TIMEOUT_MS })).stdout
-      });
-    } catch (e) {
-      localCleanup = {
-        branch: headRef,
-        localBranch: {
-          name: headRef,
-          status: "failed",
-          error: e instanceof Error ? e.message : String(e)
-        }
-      };
+    if (foreignCwd && !foreignCheckout) {
+      localCleanup = { branch: headRef, localBranch: { name: headRef, status: "not-attempted", reason: "skipped-foreign-cwd" } };
+    } else {
+      try {
+        localCleanup = await cleanupPrMergeLocalBranch(headRef, {
+          beforeWorktrees,
+          startingPath,
+          baseRef,
+          primaryRoot,
+          preserveWorktree: o.preserveWorktree,
+          gcAcknowledged: o.gc,
+          expectedHeadOid: headRefOid,
+          pathExists: (p) => (0, import_node_fs42.existsSync)(p),
+          // #5899: pin cleanup git calls to the main checkout — the task worktree this process may be
+          // standing in is removed mid-cleanup, so a cwd-relative invocation fails with
+          // 'fatal: not a git repository' and leaves a spurious partial-cleanup exit.
+          execGit: async (args) => (await execFileP("git", cleanupGitArgs(primaryRoot, args), { timeout: GIT_TIMEOUT_MS })).stdout
+        });
+      } catch (e) {
+        localCleanup = {
+          branch: headRef,
+          localBranch: {
+            name: headRef,
+            status: "failed",
+            error: e instanceof Error ? e.message : String(e)
+          }
+        };
+      }
     }
     const remoteBranch = await deleteMergedRemoteBranch({
       branch: headRef,
@@ -39592,7 +39880,9 @@ ${list}`);
       // #5899: this leg runs after worktree teardown — anchor it to the main checkout so a cwd inside
       // the removed worktree cannot turn the delete into 'fatal: not a git repository' + manual remediation.
       execGit: async (args) => (await execFileP("git", cleanupGitArgs(primaryRoot, args), { timeout: GIT_TIMEOUT_MS })).stdout,
-      branchExists: (b) => remoteBranchExists2(b, { cwd: primaryRoot })
+      branchExists: (b) => remoteBranchExists2(b, { cwd: primaryRoot, remote }),
+      // #6148: aim the delete and its proof at `--repo`, not the cwd checkout's origin.
+      remote
     });
     const worktree = localCleanup?.worktree;
     const worktreePartial = isPrMergeWorktreePartial(localCleanup) && worktree?.path ? {
@@ -39655,6 +39945,7 @@ ${list}`);
       ...methodField ? { method: methodField } : {},
       remoteBranch,
       housekeeping,
+      ...foreignCwd ? { foreignCwd: true, ...foreignCheckout ? { foreignCheckout } : {} } : {},
       ...partialCleanup.length ? { cleanupStatus: "partial", partialCleanup } : {},
       ...localCleanup?.worktree ? { worktree: localCleanup.worktree } : {},
       ...localCleanup?.localBranch ? { localBranch: localCleanup.localBranch } : {},
@@ -39970,7 +40261,7 @@ ${SSH_RECIPE_AGENT_NOTE}`);
 var import_node_child_process16 = require("node:child_process");
 var import_node_crypto12 = require("node:crypto");
 var import_node_fs45 = require("node:fs");
-var import_node_os19 = require("node:os");
+var import_node_os20 = require("node:os");
 var import_node_path41 = require("node:path");
 
 // ../scripts/distribution-digest.mjs
@@ -40121,7 +40412,7 @@ function rebuildTo(packageRoot, outDir) {
   });
 }
 function runDistStatus(root) {
-  const stage = (0, import_node_fs45.mkdtempSync)((0, import_node_path41.join)((0, import_node_os19.tmpdir)(), "mmi-dist-drift-"));
+  const stage = (0, import_node_fs45.mkdtempSync)((0, import_node_path41.join)((0, import_node_os20.tmpdir)(), "mmi-dist-drift-"));
   let overlayCount = 0;
   try {
     const cliOut = (0, import_node_path41.join)(stage, "cli-dist");
@@ -40564,8 +40855,12 @@ function registerDeveloperCommands(program3) {
   registerSchedulesCommands(program3);
   registerSchedulesLiftCommand(program3);
   const docs = program3.command("docs").description("generated docs surfaces \u2014 the routing index (org knowledge layer)");
-  docs.command("index").description("regenerate docs/index.md from the docs/ tree (--write, the default) or fail on drift (--check) \u2014 the generated routing index, never hand-maintained").option("--check", "compare against the committed docs/index.md and exit 1 on drift; never write").option("--write", "regenerate docs/index.md when it has drifted (the default)").action(async (o) => {
+  docs.command("index").description("regenerate docs/index.md from the docs/ tree (--write, the default) or fail on drift (--check) \u2014 the generated routing index, never hand-maintained").option("--check", "compare against the committed docs/index.md and exit 1 on drift; never write").option("--write", "regenerate docs/index.md when it has drifted (the default)").addOption(new Option("--repo <owner/repo>", "not accepted \u2014 docs index reads the current checkout").hideHelp()).action(async (o) => {
     try {
+      if (o.repo) {
+        const guard = planTrainApplyRepoGuard(o.repo, await resolveRepo(), `mmi-cli oracle docs index ${o.check ? "--check" : "--write"}`, "docs index");
+        if (!guard.ok) return failGraceful(guard.message);
+      }
       const root = await repoRoot();
       const result = docsIndex(createDocsIndexDeps(root), { check: Boolean(o.check) });
       if (o.check) {
@@ -40580,8 +40875,12 @@ function registerDeveloperCommands(program3) {
       await failGraceful(e.message);
     }
   });
-  docs.command("refs").description("deterministic doc reference gate: every backticked repo path, relative .md link, `mmi-cli` command ref, and `<!-- pinned by \u2014 -->` comment across docs/** + README.md + architecture.md must resolve, or exit 1 (#3339)").option("--json", "machine-readable findings list: { ok, docCount, findings[], warnings[] }").action(async (o) => {
+  docs.command("refs").description("deterministic doc reference gate: every backticked repo path, relative .md link, `mmi-cli` command ref, and `<!-- pinned by \u2014 -->` comment across docs/** + README.md + architecture.md must resolve, or exit 1 (#3339)").option("--json", "machine-readable findings list: { ok, docCount, findings[], warnings[] }").addOption(new Option("--repo <owner/repo>", "not accepted \u2014 docs refs reads the current checkout").hideHelp()).action(async (o) => {
     try {
+      if (o.repo) {
+        const guard = planTrainApplyRepoGuard(o.repo, await resolveRepo(), `mmi-cli oracle docs refs${o.json ? " --json" : ""}`, "docs refs");
+        if (!guard.ok) return failGraceful(guard.message);
+      }
       const root = await repoRoot();
       const commandPaths = new Set(
         buildCommandManifest(program3).index.map((entry) => entry.path)
@@ -40607,8 +40906,12 @@ function registerDeveloperCommands(program3) {
     }
   });
   const spawnCmd = program3.command("spawn").description("this repo's process-spawn contract \u2014 every child process must be unable to pop a console window");
-  spawnCmd.command("policy").description("enforce the windowsHide contract across this repo's tracked source: a child_process call must set windowsHide, or take its options from a named constant, a type annotation, or a forwarded caller bag that does. Waive a call the scan cannot classify with a `// windows-hide-exempt: <reason>` comment on the line above it (#3979)").option("--json", "machine-readable result: { ok, scannedCount, findings[] }").action(async (o) => {
+  spawnCmd.command("policy").description("enforce the windowsHide contract across this repo's tracked source: a child_process call must set windowsHide, or take its options from a named constant, a type annotation, or a forwarded caller bag that does. Waive a call the scan cannot classify with a `// windows-hide-exempt: <reason>` comment on the line above it (#3979)").option("--json", "machine-readable result: { ok, scannedCount, findings[] }").addOption(new Option("--repo <owner/repo>", "not accepted \u2014 spawn policy reads the current checkout").hideHelp()).action(async (o) => {
     try {
+      if (o.repo) {
+        const guard = planTrainApplyRepoGuard(o.repo, await resolveRepo(), `mmi-cli spawn policy${o.json ? " --json" : ""}`, "spawn policy");
+        if (!guard.ok) return failGraceful(guard.message);
+      }
       const root = await repoRoot();
       const result = runSpawnPolicy(root);
       if (o.json) {
@@ -40630,8 +40933,13 @@ function registerDeveloperCommands(program3) {
     }
   });
   const tests = program3.command("tests").description("a repo's test-policy.json \u2014 the opt-in test contract and its enforcement");
-  tests.command("policy").description("enforce this repo's test-policy.json against the diff: a mandatory-zone change must carry a test, an unrequested new test file is refused, a `protected` test file may not be deleted or renamed away, and a `protected` entry naming a missing file is refused. Override any of them with a `Test-Policy-Override: <reason>` commit trailer (#3605)").option("--json", "machine-readable result: { ok, base, policySource: { ref, sha, path }, root, changedCount, mandatoryCount, matchedMandatoryCount, matchedMandatoryGlobs, testCommandsAllowed, commandClasses, findings[] }").option("--base <ref>", "comparison base (default: TEST_POLICY_BASE, then origin/development, then origin/main)").option("--policy-ref <commit>", "load only test-policy.json from the exact fetched origin/development commit; valid only with --base origin/main").action(async (o) => {
+  tests.command("policy").description("enforce this repo's test-policy.json against the diff: a mandatory-zone change must carry a test, an unrequested new test file is refused, a `protected` test file may not be deleted or renamed away, and a `protected` entry naming a missing file is refused. Override any of them with a `Test-Policy-Override: <reason>` commit trailer (#3605)").option("--json", "machine-readable result: { ok, base, policySource: { ref, sha, path }, root, changedCount, mandatoryCount, matchedMandatoryCount, matchedMandatoryGlobs, testCommandsAllowed, commandClasses, findings[] }").option("--base <ref>", "comparison base (default: TEST_POLICY_BASE, then origin/development, then origin/main)").option("--policy-ref <commit>", "load test-policy.json from the exact fetched origin/development commit and audit its protected/satisfiedBy paths against that commit's tree, not this checkout; valid only with --base origin/main").addOption(new Option("--repo <owner/repo>", "not accepted \u2014 tests policy reads the current checkout").hideHelp()).action(async (o) => {
     try {
+      if (o.repo) {
+        const rerun = `mmi-cli tests policy${o.base ? ` --base ${o.base}` : ""}${o.policyRef ? ` --policy-ref ${o.policyRef}` : ""}${o.json ? " --json" : ""}`;
+        const guard = planTrainApplyRepoGuard(o.repo, await resolveRepo(), rerun, "tests policy");
+        if (!guard.ok) return failGraceful(guard.message);
+      }
       const root = await repoRoot();
       const result = runTestPolicy(root, { base: o.base, policyRef: o.policyRef });
       if (o.json) {
@@ -40661,8 +40969,12 @@ function registerDeveloperCommands(program3) {
     }
   });
   const distCmd = program3.command("dist").description("this repo's committed dist/BOM drift receipt \u2014 whether cli/dist, updater/dist and distribution-bom.json still match a fresh build of source");
-  distCmd.command("status").description("rebuild every committed dist artifact to a temp dir and report committed vs rebuilt-expected sha256 plus the BOM's recorded dist identities \u2014 a visible, non-blocking receipt. Development checkouts may lag source until the release fold; drift NEVER fails the run, and nothing is refreshed for you (#5576)").option("--json", "machine-readable receipt: { ok, staleCount, artifacts[], bom, summary } (full hashes; drift still exits 0)").action(async (o) => {
+  distCmd.command("status").description("rebuild every committed dist artifact to a temp dir and report committed vs rebuilt-expected sha256 plus the BOM's recorded dist identities \u2014 a visible, non-blocking receipt. Development checkouts may lag source until the release fold; drift NEVER fails the run, and nothing is refreshed for you (#5576)").option("--json", "machine-readable receipt: { ok, staleCount, artifacts[], bom, summary } (full hashes; drift still exits 0)").addOption(new Option("--repo <owner/repo>", "not accepted \u2014 dist status reads the current checkout").hideHelp()).action(async (o) => {
     try {
+      if (o.repo) {
+        const guard = planTrainApplyRepoGuard(o.repo, await resolveRepo(), `mmi-cli dist status${o.json ? " --json" : ""}`, "dist status");
+        if (!guard.ok) return failGraceful(guard.message);
+      }
       const root = await repoRoot();
       const receipt = runDistStatus(root);
       if (o.json) {
@@ -40957,7 +41269,7 @@ async function resolveHotfixDeployModel(deps, ctx) {
 }
 async function hotfixPreflight(deps, ctx, verb, targetTag) {
   const meta = requireProjectMetaForTrain(await loadProjectMeta(deps, ctx), ctx.repo);
-  const deployModel = await preflight(deps, ctx, "main", meta);
+  const deployModel = await preflight(deps, ctx, "main", meta, "hotfix");
   const root = await hotfixCheckoutRoot(deps);
   const begin = await beginReleaseLedger(deps, root, targetTag);
   if (!begin.ok) throw new Error(`hotfix ${verb} refused before any mutation: ${begin.error}`);
@@ -41316,6 +41628,16 @@ function hotfixDispatchFromRuns(runs, note) {
   const tenantDeploy2 = runs.find((r) => r.workflow === "tenant-deploy.yml");
   return { note, deployStatus, workflowRuns, ...tenantDeploy2?.runId != null ? { runId: tenantDeploy2.runId } : {}, ...tenantDeploy2?.url ? { runUrl: tenantDeploy2.url } : {} };
 }
+async function appendHotfixGatewayRun(deps, repo, tag, sha, runs, note) {
+  const input = hotfixDispatchFromRuns(runs, note);
+  const gateway = await appendJervGatewayReleaseDeploy(deps, repo, tag, sha, input);
+  if (gateway === input) return note;
+  const row = gateway.workflowRuns?.at(-1);
+  if (row?.workflow === "jerv-gateway") {
+    runs.push({ workflow: row.workflow, ...row.runUrlNote ? { runUrlNote: row.runUrlNote } : {}, conclusion: row.conclusion });
+  }
+  return gateway.note;
+}
 function hotfixPhaseInputsFromRuns(deployModel, runs, note, publishDispatch, publishRequired, opts) {
   const dispatch = hotfixDispatchFromRuns(runs, note);
   return {
@@ -41559,6 +41881,7 @@ ${decision.note}`);
   } else {
     deployNote = `no hotfix deploy dispatch for deployModel=${deployModel} \u2014 prod deploy is repo-specific`;
   }
+  deployNote = await appendHotfixGatewayRun(deps, ctx.repo, tag, mergedSha, runs, deployNote);
   const ledgerInputs = hotfixPhaseInputsFromRuns(
     deployModel,
     runs,
@@ -41751,6 +42074,9 @@ function hotfixStatusRunsFromLedger(ledger) {
       workflow: record.workflow ?? phase,
       ...record.runId != null ? { runId: record.runId } : {},
       ...record.runUrl ? { url: record.runUrl } : {},
+      // #912: the operator-host Gateway leg carries no run id by design — without its own note the
+      // renderer's missing-URL fallback reads it as 'run absent or unreadable'.
+      ...record.workflow === "jerv-gateway" ? { runUrlNote: JERV_GATEWAY_RUN_URL_NOTE } : {},
       conclusion: record.state === "complete" ? "success" : record.state === "failed" ? "failure" : "pending"
     }];
   });
@@ -42231,6 +42557,7 @@ function renderReleaseResume(r) {
   if (r.devRollForward) lines2.push(`  development: ${r.devRollForward.note}`);
   if (r.rcAlignment) lines2.push(`  rc: ${r.rcAlignment.note}`);
   if (r.checkout) lines2.push(`  checkout: ${r.checkout.note}`);
+  if (r.projectInfoSync) lines2.push(`  project info: ${r.projectInfoSync.note}`);
   if (r.ledger) lines2.push(...formatReleaseLedgerReport(r.ledger).map((l, i) => i === 0 ? `  ${l}` : `  ${l}`));
   return lines2.join("\n");
 }
@@ -42258,7 +42585,8 @@ function releaseFollowUpLegs(result, projectInfoSync) {
   const legs = [
     {
       leg: "project-info",
-      status: projectInfoSync && "error" in projectInfoSync ? "failed" : "success",
+      // #6180: a transient Hub read outage is PENDING (rerun the manual verb), never a failed follow-up.
+      status: projectInfoSync && "error" in projectInfoSync ? projectInfoSync.pending ? "pending" : "failed" : "success",
       ...projectInfoSync && "error" in projectInfoSync ? { error: projectInfoSync.error } : {}
     }
   ];
@@ -42297,6 +42625,24 @@ function releaseFollowUpLegs(result, projectInfoSync) {
   }
   return legs;
 }
+function hotfixFollowUpLegs(runs, foldPort, alignment, foldNote, deployNote) {
+  const legs = runs.map((run) => ({
+    leg: run.workflow,
+    status: followUpLegStatus(run.conclusion === "failure" ? "failure" : run.conclusion === "success" ? "success" : "pending"),
+    // #912 lane parity with releaseFollowUpLegs: the operator-host Gateway leg has no workflow run to
+    // read, so its deploy note IS the error — a flat "workflow reported failure" names nothing.
+    ...run.conclusion === "failure" ? { error: run.workflow === "jerv-gateway" && deployNote ? deployNote : "workflow reported failure" } : {}
+  }));
+  if (foldPort === "failure") {
+    legs.push({ leg: "development-fold-port", status: "failed", error: foldNote ?? "development fold port failed" });
+  }
+  if (alignment === "unresolved") {
+    legs.push({ leg: "development-fold-alignment", status: "pending" });
+  } else if (alignment === "failure" && foldPort !== "failure") {
+    legs.push({ leg: "development-fold-alignment", status: "failed", error: foldNote ?? "development fold alignment failed" });
+  }
+  return legs;
+}
 var JERV_POWERTOOLS_REPO = "mutmutco/Jerv-PowerTools";
 async function runPostReleaseJervDoctor(repo) {
   if (repo.toLowerCase() !== JERV_POWERTOOLS_REPO.toLowerCase()) return void 0;
@@ -42312,10 +42658,35 @@ async function runPostReleaseJervDoctor(repo) {
     };
   }
 }
+async function runProjectInfoSyncLeg(cb, repo, sleep2 = (ms) => new Promise((resolve7) => setTimeout(resolve7, ms))) {
+  for (let attempt = 0; ; attempt++) {
+    try {
+      return await cb(repo, true);
+    } catch (e) {
+      const error = e.message;
+      if (!(e instanceof ProjectInfoReadUnavailableError)) return { applied: false, note: `FAILED \u2014 ${error}`, error };
+      if (attempt === 0) {
+        await sleep2(PROJECT_INFO_RETRY_MS);
+        continue;
+      }
+      return {
+        applied: false,
+        pending: true,
+        note: `PENDING \u2014 ${error}; rerun \`mmi-cli oracle org project sync-info ${repo} --apply\``,
+        error
+      };
+    }
+  }
+}
+var PROJECT_INFO_RETRY_MS = 3e3;
+function projectInfoOutcome(projectInfoSync) {
+  if (!projectInfoSync || !("error" in projectInfoSync)) return "ok";
+  return projectInfoSync.pending ? "unresolved" : "failure";
+}
 function buildReleaseVerdict(commandName, result, projectInfoSync) {
   const alignmentPending = result.devRollForward?.status === "pr-pending" || result.rcAlignment?.status === "pr-pending";
   const followUpStatus = deriveTrainFollowUpStatus({
-    projectInfo: projectInfoSync && "error" in projectInfoSync ? "failure" : "ok",
+    projectInfo: projectInfoOutcome(projectInfoSync),
     deploy: deployFollowUpOutcome(result.deployStatus),
     rcRetirement: result.rcRetirement === "failed" ? result.rcRetirementCategory === "wait-timeout" ? "unresolved" : "failure" : "ok",
     alignment: alignmentPending ? "unresolved" : "ok",
@@ -42496,8 +42867,17 @@ function registerTrainOperationsCommands(program3, runProjectInfoSyncCallback) {
           }
           const raw = await runReleaseResume(trainApplyDeps(), { watch: o.watch, announceSummaryFile: o.announceSummaryFile });
           const result = raw.dispatch?.workflowRuns ? { ...raw, dispatch: { ...raw.dispatch, workflowRuns: raw.dispatch.workflowRuns.map(workflowRunWithEvidence) } } : raw;
-          emitTrainResult("release --resume", o.json ? JSON.stringify(result, null, 2) : renderReleaseResume(result), o.out);
-          applyTrainFollowUpExit(resumeFollowUpOf(result.state));
+          const projectInfoSync = await runProjectInfoSyncLeg(runProjectInfoSyncCallback, result.repo);
+          const resumed = { ...result, projectInfoSync };
+          emitTrainResult("release --resume", o.json ? JSON.stringify(resumed, null, 2) : renderReleaseResume(resumed), o.out);
+          const resumeStatus = resumeFollowUpOf(result.state);
+          applyTrainFollowUpExit(deriveTrainFollowUpStatus({
+            projectInfo: projectInfoOutcome(projectInfoSync),
+            deploy: "ok",
+            rcRetirement: "ok",
+            alignment: resumeStatus === "failed" ? "failure" : resumeStatus === "pending" ? "unresolved" : "ok",
+            foldPort: "ok"
+          }));
           return;
         } catch (e) {
           applyTrainFollowUpExit("failed");
@@ -42535,12 +42915,7 @@ function registerTrainOperationsCommands(program3, runProjectInfoSyncCallback) {
           let projectInfoSync;
           const postReleaseJervDoctor = commandName === "release" ? await runPostReleaseJervDoctor(result.repo) : void 0;
           if (commandName === "release") {
-            try {
-              projectInfoSync = await runProjectInfoSyncCallback(result.repo, true);
-            } catch (e) {
-              const error = e.message;
-              projectInfoSync = { applied: false, note: `FAILED \u2014 ${error}`, error };
-            }
+            projectInfoSync = await runProjectInfoSyncLeg(runProjectInfoSyncCallback, result.repo);
           }
           const { followUpStatus, releaseVerdict } = buildReleaseVerdict(commandName, result, projectInfoSync);
           const reported = {
@@ -42637,22 +43012,6 @@ function registerTrainOperationsCommands(program3, runProjectInfoSyncCallback) {
     if (conclusion === "failure") return "failure";
     return "unresolved";
   }
-  function hotfixFollowUpLegs(runs, foldPort, alignment, foldNote) {
-    const legs = runs.map((run) => ({
-      leg: run.workflow,
-      status: followUpLegStatus(run.conclusion === "failure" ? "failure" : run.conclusion === "success" ? "success" : "pending"),
-      ...run.conclusion === "failure" ? { error: "workflow reported failure" } : {}
-    }));
-    if (foldPort === "failure") {
-      legs.push({ leg: "development-fold-port", status: "failed", error: foldNote ?? "development fold port failed" });
-    }
-    if (alignment === "unresolved") {
-      legs.push({ leg: "development-fold-alignment", status: "pending" });
-    } else if (alignment === "failure" && foldPort !== "failure") {
-      legs.push({ leg: "development-fold-alignment", status: "failed", error: foldNote ?? "development fold alignment failed" });
-    }
-    return legs;
-  }
   async function runHotfixSub(sub, body, o, render) {
     try {
       await requireFreshTrainCli("hotfix");
@@ -42664,11 +43023,12 @@ function registerTrainOperationsCommands(program3, runProjectInfoSyncCallback) {
       const ledger = result.ledger;
       const alignment = result.alignmentStatus ?? ledgerAlignmentFollowUpOutcome(ledger);
       const projectInfoSync = result.projectInfoSync;
-      const legs = runs ? hotfixFollowUpLegs(runs, foldPort, alignment, result.foldNote) : void 0;
+      const deployNote = result.deployNote ?? ledger?.phases.deploy.error ?? ledger?.phases.deploy.note;
+      const legs = runs ? hotfixFollowUpLegs(runs, foldPort, alignment, result.foldNote, deployNote) : void 0;
       const json = o.json || Boolean(hotfixCmd.opts().json);
       emitTrainResult(`hotfix ${sub}`, json ? JSON.stringify(legs ? Object.assign({}, result, { legs }) : result, null, 2) : render(result), o.out);
       if (runs) applyTrainFollowUpExit(deriveTrainFollowUpStatus({
-        projectInfo: projectInfoSync && "error" in projectInfoSync ? "failure" : "ok",
+        projectInfo: projectInfoOutcome(projectInfoSync),
         deploy: reduceFollowUpOutcomes(runs.map((r) => hotfixRunOutcome(r.conclusion))),
         rcRetirement: "ok",
         alignment,
@@ -42692,13 +43052,7 @@ function registerTrainOperationsCommands(program3, runProjectInfoSyncCallback) {
   hotfixCmd.command("release <version>").description("after the hotfix PR is merged + checks green: tag, GitHub Release, watch deploy/publish, verify distribution (idempotent)").option("--json", "machine-readable output").option("--announce-summary-file <path>", "agent-curated 3-6 line Hub Slack summary; required for a NEW MMI-Hub hotfix Release (#883/#3901/#6068)").option("--carries <pr#|sha[,pr#|sha...]>", "declared fix target(s) this hotfix must carry; each must be proven present before tagging (#3056)").option("--out <path>", "write the result to this file as UTF-8 (no BOM) instead of stdout \u2014 the shell-free receipt path (#5983/#6068)").action(async (version, o) => runHotfixSub("release", async () => {
     const result = await runHotfixRelease(trainApplyDeps(), version, { announceSummaryFile: o.announceSummaryFile, carries: o.carries ? [o.carries] : [] });
     const postReleaseJervDoctor = await runPostReleaseJervDoctor(result.repo);
-    let projectInfoSync;
-    try {
-      projectInfoSync = await runProjectInfoSyncCallback(result.repo, true);
-    } catch (e) {
-      const error = e.message;
-      projectInfoSync = { applied: false, note: `FAILED \u2014 ${error}`, error };
-    }
+    const projectInfoSync = await runProjectInfoSyncLeg(runProjectInfoSyncCallback, result.repo);
     return { ...result, projectInfoSync, ...postReleaseJervDoctor ? { postReleaseJervDoctor } : {} };
   }, o, renderHotfixRelease));
   function hotfixStatusDeps() {
@@ -42742,7 +43096,7 @@ function envHealLockPath(home) {
 async function withEnvHealLock(what, run) {
   try {
     return await withFileLock(
-      envHealLockPath((0, import_node_os20.homedir)()),
+      envHealLockPath((0, import_node_os21.homedir)()),
       { staleMs: ENV_HEAL_LOCK_STALE_MS, maxWaitMs: ENV_HEAL_LOCK_MAX_WAIT_MS, label: "mmi env-heal lock" },
       run
     );
@@ -42838,7 +43192,7 @@ function mmiDoctorDeps(opts = {}) {
       const configRoot = surfaceConfigRoot(surface);
       const running = surface === "codex" ? installedActivePluginVersion(surface) : runningPluginVersion(process.env, resolveClientVersion());
       const plan = buildPluginCachePlan(
-        (0, import_node_os20.homedir)(),
+        (0, import_node_os21.homedir)(),
         running,
         pluginCacheFsDeps(configRoot, () => 0),
         { configRoot, includeStaging: surface !== "codex" }
@@ -42866,7 +43220,7 @@ function mmiDoctorDeps(opts = {}) {
       const running = surface === "codex" ? installedActivePluginVersion(surface) : runningPluginVersion(process.env, resolveClientVersion());
       const installed = installedActivePluginVersion(surface);
       const plan = buildPluginCachePlan(
-        (0, import_node_os20.homedir)(),
+        (0, import_node_os21.homedir)(),
         running,
         pluginCacheFsDeps(configRoot, () => 0),
         { configRoot, includeStaging: surface !== "codex", installedVersion: installed }
@@ -43279,7 +43633,7 @@ tenant.command("reconcile <owner/repo> <stage>").description("re-render this ten
     return failGraceful(`runtime tenant reconcile: ${e.message}`);
   }
 });
-tenant.command("status <owner/repo> <stage>").description("read tenant runtime readiness without dispatching tenant-control: DEPLOY row, last deploy run, public URL probe, and TLS/Caddy/Cloudflare hints").action(async (repo, stage) => {
+tenant.command("status <owner/repo> <stage>").description("read tenant runtime readiness without dispatching tenant-control: DEPLOY row, last deploy run, public URL probe, and TLS/Caddy/Cloudflare hints; an auth-walled root (401/403) is re-probed at /health and the `url` field names the endpoint that answered (#6137)").action(async (repo, stage) => {
   if (!["dev", "rc", "main"].includes(stage)) return fail("runtime tenant status: <stage> must be dev, rc, or main");
   const cfg = await loadConfig();
   const result = await buildTenantRuntimeStatusFor(repo, stage, cfg);
@@ -43321,26 +43675,13 @@ tenant.command("sweep-rc").description("discover (and optionally retire) running
     return failGraceful(`runtime tenant sweep-rc: ${e.message}`);
   }
 });
-async function probeHttpBounded2(url, timeoutMs = 5e3) {
-  const controller = new AbortController();
-  const timeout = setTimeout(() => controller.abort(), timeoutMs);
-  timeout.unref?.();
-  try {
-    const res = await fetch(url, { method: "GET", signal: controller.signal });
-    return { ok: res.ok, status: res.status };
-  } catch (e) {
-    return { ok: false, error: e.message };
-  } finally {
-    clearTimeout(timeout);
-  }
-}
 async function buildTenantRuntimeStatusFor(target, stage, cfg) {
   const slug = slugOf(target);
   const reg = registryClientDeps(cfg);
   const facts = await fetchDeployFactsBySlug(slug, reg);
   const deploy = facts?.stages[stage] ?? null;
   const publicUrl = publicUrlFromDeployFact(deploy);
-  const publicProbe = publicUrl ? await probeHttpBounded2(publicUrl) : void 0;
+  const publicProbe = publicUrl ? await probePublicHealth(publicUrl) : void 0;
   return buildTenantRuntimeStatus({
     repo: target,
     slug,
@@ -43368,9 +43709,9 @@ async function runProjectInfoSync(target, apply) {
     fetchProjectBySlugChecked(slugOf(targetRepo2), registry2),
     fetchProjectsList(registry2)
   ]);
-  if (!read.ok) throw new Error(`org project sync-info: Hub registry read failed (${read.error})`);
+  if (!read.ok) throw new ProjectInfoReadUnavailableError(`org project sync-info: Hub registry read failed (${read.error})`);
   if (!read.project) throw new Error(`org project sync-info: no registry META for ${targetRepo2}`);
-  if (!projects) throw new Error("org project sync-info: Hub project list unavailable");
+  if (!projects) throw new ProjectInfoReadUnavailableError("org project sync-info: Hub project list unavailable");
   if (apply) {
     const authority = await fetchTrainAuthority(targetRepo2, registry2);
     if (!authority.ok) throw new Error(`org project sync-info: train authority unverified (${authority.error})`);
@@ -44017,7 +44358,7 @@ program2.command("plugin-prune").description(`prune stale cached MMI plugin vers
     return;
   }
   const plan = buildPluginCachePlan(
-    (0, import_node_os20.homedir)(),
+    (0, import_node_os21.homedir)(),
     running,
     pluginCacheFsDeps(configRoot, directoryBytes),
     { withBytes: true, configRoot, includeStaging: surface !== "codex" }