@mutmutco/cli 4.5.117 → 4.5.119

package/dist/main.cjs

@@ -1178,7 +1178,9 @@ function commandFromFailMessage(msg) {
   const head = msg.split(":", 1)[0].trim();
   if (!head || head.startsWith("-")) return "mmi-cli";
   if (!/^[a-z][a-z0-9-]*(?: [a-z][a-z0-9-]*){0,5}$/.test(head)) return "mmi-cli";
-  return canonicalPathFor(head) ?? head;
+  const canonical = canonicalPathFor(head);
+  if (canonical) return canonical;
+  return HOUSE_ROOTS.includes(head.split(" ")[0]) ? head : "mmi-cli";
 }
 function canonicalFailMessage(msg) {
   const colon = msg.indexOf(":");
@@ -4751,7 +4753,7 @@ function useColor() {
 var program = new Command();
 
 // src/command-composition.ts
-var import_node_fs55 = require("node:fs");
+var import_node_fs57 = require("node:fs");
 init_clean_exit();
 init_cli_shared();
 
@@ -5653,13 +5655,13 @@ function resolveVerbAliasShim(argv) {
 }
 
 // src/command-composition.ts
-var import_node_os24 = require("node:os");
-var import_node_path53 = require("node:path");
+var import_node_os25 = require("node:os");
+var import_node_path54 = require("node:path");
 
 // src/board-read.ts
-var import_node_fs13 = require("node:fs");
-var import_node_os9 = require("node:os");
-var import_node_path11 = require("node:path");
+var import_node_fs14 = require("node:fs");
+var import_node_os10 = require("node:os");
+var import_node_path12 = require("node:path");
 init_cli_shared();
 init_github_client();
 
@@ -5667,21 +5669,35 @@ init_github_client();
 init_fetch_retry();
 init_client_version();
 var BOARD_SNAPSHOT_TIMEOUT_MS = 25e3;
+var BOARD_SNAPSHOT_EXIT_CODES = {
+  "hub-unreachable": 20,
+  "app-quota-exhausted": 21,
+  refused: 22
+};
+var BoardSnapshotFailure = class extends Error {
+  constructor(receipt) {
+    super(receipt.reason);
+    this.receipt = receipt;
+    this.exitCode = BOARD_SNAPSHOT_EXIT_CODES[receipt.outcome];
+  }
+  receipt;
+  exitCode;
+};
 function isSnapshotShape(body) {
   const b = body;
   const rate = b?.github?.rateLimit;
   const staleValid = b?.stale === void 0 || typeof b.stale === "object" && b.stale !== null && Number.isFinite(b.stale.ageMs) && b.stale.ageMs >= 0;
-  const githubValid = b?.github === void 0 || b.github.credential === "app_installation" && (rate === void 0 || Number.isFinite(rate?.limit) && Number.isFinite(rate?.remaining) && Number.isFinite(rate?.cost) && typeof rate?.resetAt === "string");
+  const githubValid = b?.github === void 0 || b.github !== null && typeof b.github === "object" && b.github.credential === "app_installation" && (rate === void 0 || Number.isFinite(rate?.limit) && Number.isFinite(rate?.remaining) && Number.isFinite(rate?.cost) && typeof rate?.resetAt === "string");
   return Boolean(
     b && typeof b === "object" && typeof b.project?.id === "string" && typeof b.project?.title === "string" && typeof b.viewer === "string" && b.viewer.length > 0 && Array.isArray(b.nodes) && Array.isArray(b.writableRepos) && Array.isArray(b.unreadableRepos) && Array.isArray(b.pullRequests) && Array.isArray(b.warnings) && typeof b.partial === "boolean" && (b.source === void 0 || b.source === "live" || b.source === "cache") && (b.builtAt === void 0 || typeof b.builtAt === "string" && Number.isFinite(Date.parse(b.builtAt))) && (b.eventCursor === void 0 || Number.isInteger(b.eventCursor) && b.eventCursor >= 0) && githubValid && staleValid
   );
 }
 async function fetchHubBoardSnapshot(request, deps) {
   if (!deps.baseUrl) return { state: "unavailable", reason: "no Hub API URL (set MMI_HUB_URL or use a current MMI CLI/plugin build)" };
-  const token = await deps.token();
-  if (!token) return { state: "unavailable", reason: "no Hub session token (run `gh auth login`)" };
   let res;
   try {
+    const token = await deps.token();
+    if (!token) return { state: "unavailable", reason: "no Hub session token (run `gh auth login`)" };
     res = await fetchWithRetry(
       deps.fetch ?? fetch,
       `${deps.baseUrl.replace(/\/$/, "")}/board/snapshot`,
@@ -5715,10 +5731,26 @@ async function fetchHubBoardSnapshot(request, deps) {
       return {
         state: "unavailable",
         reason: `GitHub App quota exhausted${reset}`,
+        appQuotaExhausted: true,
+        pool: "graphql",
+        ...typeof body2.resetAt === "string" ? { resetAt: body2.resetAt } : {},
         ...body2.github?.credential === "app_installation" && body2.github.resource === "graphql" && /^github-app-v1:[a-f0-9]{64}$/.test(body2.github.quotaScope ?? "") ? { quota: { status: "rate_limited", ...typeof body2.resetAt === "string" ? { resetAt: body2.resetAt } : {}, github: { credential: "app_installation", resource: "graphql", quotaScope: body2.github.quotaScope } } } : {}
       };
     }
   }
+  if (res.status === 503) {
+    const body2 = await res.json().catch(() => null);
+    if (body2?.code === "github-rate-limited") {
+      const reset = typeof body2.resetAt === "string" ? `; resets ${body2.resetAt}` : "; reset time unavailable";
+      return {
+        state: "unavailable",
+        reason: `GitHub App allowance exhausted${reset}`,
+        appQuotaExhausted: true,
+        pool: "rest",
+        ...typeof body2.resetAt === "string" ? { resetAt: body2.resetAt } : {}
+      };
+    }
+  }
   if (!res.ok) return { state: "unavailable", reason: `board snapshot HTTP ${res.status}` };
   const body = await res.json().catch(() => null);
   if (!isSnapshotShape(body)) return { state: "unavailable", reason: "malformed board snapshot response" };
@@ -5816,6 +5848,22 @@ var activeQuotaScope;
 function activeAppQuotaScope() {
   return activeQuotaScope;
 }
+var activeToken;
+function activeAppToken() {
+  return activeToken;
+}
+async function readAppVaultSecret(read) {
+  try {
+    return await read();
+  } catch (e) {
+    const reason = e.message;
+    if (/^(Hub GitHub App allowance used up|rate limited)/.test(reason)) {
+      throw new AppActorError(`app actor: the vault could not read the App credentials because GitHub is rate-limited, not a denial: ${reason}`, "mint-failed");
+    }
+    if (/^authority refused|\(HTTP 404\b/.test(reason)) return null;
+    throw new AppActorError(`app actor: the vault read of the App credentials failed, not a denial: ${reason}`, "mint-failed");
+  }
+}
 async function mintInstallationToken(deps) {
   const [appId, installationId, privateKey] = await Promise.all(APP_VAULT_KEYS.map((k) => deps.fetchSecret(k)));
   if (!appId || !installationId || !privateKey) {
@@ -5875,6 +5923,7 @@ var notedIneligibleCommand = false;
 async function activateAppActor(commandPath3, env, mint, note = (line) => process.stderr.write(`${line}
 `)) {
   activeQuotaScope = void 0;
+  activeToken = void 0;
   const requested = (env[APP_ACTOR_ENV] ?? "").trim();
   if (!requested) return "personal";
   if (requested !== "app") {
@@ -5892,6 +5941,7 @@ async function activateAppActor(commandPath3, env, mint, note = (line) => proces
   const minted = await mint();
   env.GH_TOKEN = minted.token;
   activeQuotaScope = minted.quotaScope;
+  activeToken = minted.token;
   return "app";
 }
 
@@ -6298,6 +6348,93 @@ function isReleaseShaDeployEnumerationCandidate(row, nonDeployEvents) {
 
 // src/pr-checks-rest.ts
 init_github_quota();
+
+// src/rest-etag-cache.ts
+var import_node_crypto5 = require("node:crypto");
+var import_node_fs11 = require("node:fs");
+var import_node_os4 = require("node:os");
+var import_node_path9 = require("node:path");
+var MAX_AGE_MS = 24 * 60 * 6e4;
+var MAX_ENTRIES = 256;
+var MAX_BYTES = 16 * 1024 * 1024;
+var MAX_ENTRY_BYTES = 1024 * 1024;
+function restEtagCacheDir() {
+  if (process.env.MMI_REST_ETAG_CACHE_DIR) return process.env.MMI_REST_ETAG_CACHE_DIR;
+  return process.platform === "win32" ? (0, import_node_path9.join)(process.env.LOCALAPPDATA || (0, import_node_path9.join)((0, import_node_os4.homedir)(), "AppData", "Local"), "MMI Future", "mmi-cli", "rest-etags") : (0, import_node_path9.join)(process.env.XDG_CACHE_HOME || (0, import_node_path9.join)((0, import_node_os4.homedir)(), ".cache"), "mmi-cli", "rest-etags");
+}
+function entryPath(dir, key) {
+  return (0, import_node_path9.join)(dir, `${(0, import_node_crypto5.createHash)("sha256").update(key).digest("hex")}.json`);
+}
+function readRestEtag(key, dir = restEtagCacheDir()) {
+  if (dir === "off") return void 0;
+  try {
+    const path2 = entryPath(dir, key);
+    if ((0, import_node_fs11.statSync)(path2).size > MAX_ENTRY_BYTES) return void 0;
+    const entry = JSON.parse((0, import_node_fs11.readFileSync)(path2, "utf8"));
+    const age = Date.now() - entry.storedAt;
+    if (typeof entry.etag === "string" && entry.etag && !/[\r\n]/.test(entry.etag) && typeof entry.body === "string" && Number.isFinite(entry.storedAt) && age >= 0 && age <= MAX_AGE_MS) return entry;
+  } catch {
+  }
+  return void 0;
+}
+function deleteRestEtag(key, dir = restEtagCacheDir()) {
+  if (dir === "off") return;
+  try {
+    (0, import_node_fs11.rmSync)(entryPath(dir, key), { force: true });
+  } catch {
+  }
+}
+function prune(dir) {
+  const now = Date.now();
+  const files = (0, import_node_fs11.readdirSync)(dir).filter((name) => /^[a-f0-9]{64}\.json(?:\.tmp-.+)?$/.test(name)).flatMap((name) => {
+    try {
+      const path2 = (0, import_node_path9.join)(dir, name);
+      const stat4 = (0, import_node_fs11.statSync)(path2);
+      if (now - stat4.mtimeMs > MAX_AGE_MS) {
+        (0, import_node_fs11.rmSync)(path2, { force: true });
+        return [];
+      }
+      return name.endsWith(".json") ? [{ path: path2, size: stat4.size, at: stat4.mtimeMs }] : [];
+    } catch {
+      return [];
+    }
+  }).sort((a, b) => a.at - b.at);
+  let bytes = files.reduce((sum, f) => sum + f.size, 0);
+  let count = files.length;
+  for (const file of files) {
+    if (count <= MAX_ENTRIES && bytes <= MAX_BYTES) break;
+    try {
+      (0, import_node_fs11.rmSync)(file.path, { force: true });
+      bytes -= file.size;
+      count--;
+    } catch {
+    }
+  }
+}
+function writeRestEtag(key, entry, dir = restEtagCacheDir()) {
+  if (dir === "off") return;
+  const path2 = entryPath(dir, key);
+  const tmp = `${path2}.tmp-${process.pid}-${(0, import_node_crypto5.randomUUID)()}`;
+  try {
+    const data = JSON.stringify({ etag: entry.etag, body: entry.body, storedAt: Date.now() });
+    if (Buffer.byteLength(data) > MAX_ENTRY_BYTES) {
+      deleteRestEtag(key, dir);
+      return;
+    }
+    (0, import_node_fs11.mkdirSync)(dir, { recursive: true, mode: 448 });
+    (0, import_node_fs11.writeFileSync)(tmp, data, { mode: 384, flag: "wx" });
+    (0, import_node_fs11.renameSync)(tmp, path2);
+    prune(dir);
+  } catch {
+  } finally {
+    try {
+      (0, import_node_fs11.rmSync)(tmp, { force: true });
+    } catch {
+    }
+  }
+}
+
+// src/pr-checks-rest.ts
 var REST_GH_TIMEOUT_MS = 2e4;
 var pollTokenProvider;
 var pollTokenOnce;
@@ -6382,8 +6519,9 @@ function observedCorePool(source, nowMs) {
 async function defaultGhApi(args, env = process.env) {
   const appToken = await pollToken();
   const source = appToken ? "app" : "user";
-  const key = `${source}\0${args.join("\0")}`;
-  const cached = etagCache.get(key);
+  const key = `${source}\0${env.GH_HOST || "github.com"}\0${args.join("\0")}`;
+  const cached = etagCache.get(key) ?? readRestEtag(key);
+  if (cached) etagCache.set(key, cached);
   let stdout;
   try {
     ({ stdout } = await execFileP("gh", ["api", "--include", ...cached ? ["-H", `If-None-Match: ${cached.etag}`] : [], ...args], {
@@ -6397,31 +6535,37 @@ async function defaultGhApi(args, env = process.env) {
   } catch (e) {
     const out = e.stdout;
     const errOut = typeof out === "string" ? out : void 0;
-    const status = errOut !== void 0 ? parseIncludedOutput(errOut).status : void 0;
+    const status2 = errOut !== void 0 ? parseIncludedOutput(errOut).status : void 0;
     if (errOut !== void 0) notePoolHeaders(source, errOut, Date.now());
-    if (cached && status === 304) {
+    if (cached && status2 === 304) {
       lastPollSource = source;
       return cached.body;
     }
-    if (status === 403 || status === 429) {
+    if (status2 === 403 || status2 === 429) {
       const path2 = args.filter((a) => !a.startsWith("-")).join(" ") || args.join(" ");
       const refusal = errOut !== void 0 ? describeRefusal(errOut) : "no rate-limit headers or message";
-      if (status === 403 && /Resource not accessible by integration/i.test(refusal)) {
+      if (status2 === 403 && /Resource not accessible by integration/i.test(refusal)) {
         throw new Error(
           `poll read refused: App token lacks permission for ${path2} (HTTP 403, response: ${refusal}) \u2014 reads never fall back to the owner's token (#8030); add the permission to APP_POLL_PERMISSIONS / the App installation`
         );
       }
       throw Object.assign(new Error(
-        `poll read refused on the ${source} pool (HTTP ${status}, response: ${refusal}) \u2014 reads stay on the ${source === "app" ? "App" : "ambient identity"} (#8030); the wait re-arms after reset`
-      ), { status, stdout: errOut, stderr: e.stderr });
+        `poll read refused on the ${source} pool (HTTP ${status2}, response: ${refusal}) \u2014 reads stay on the ${source === "app" ? "App" : "ambient identity"} (#8030); the wait re-arms after reset`
+      ), { status: status2, stdout: errOut, stderr: e.stderr });
     }
     throw e;
   }
-  const { body, etag, pages } = parseIncludedOutput(stdout);
+  const { body, status, etag, pages } = parseIncludedOutput(stdout);
   notePoolHeaders(source, stdout, Date.now());
   lastPollSource = source;
-  if (etag && pages === 1) etagCache.set(key, { etag, body });
-  else etagCache.delete(key);
+  if (cached && status === 304) return cached.body;
+  if (status === 200 && etag && pages === 1) {
+    etagCache.set(key, { etag, body });
+    writeRestEtag(key, { etag, body });
+  } else {
+    etagCache.delete(key);
+    deleteRestEtag(key);
+  }
   return body;
 }
 function classifyCheckRun(run) {
@@ -8526,12 +8670,12 @@ async function fetchSchedulesList(deps) {
     return null;
   }
 }
-async function fetchOrgConfig(deps) {
+async function fetchOrgConfig(deps, spendMinutes) {
   if (!deps.baseUrl) return null;
   const token = await deps.token();
   if (!token) return null;
   try {
-    const res = await retriedFetch(deps, `${deps.baseUrl.replace(/\/$/, "")}${ORG_CONFIG_PATH}`, {
+    const res = await retriedFetch(deps, `${deps.baseUrl.replace(/\/$/, "")}${ORG_CONFIG_PATH}${spendMinutes === void 0 ? "" : `?github-spend-minutes=${spendMinutes}`}`, {
       method: "GET",
       headers: { Authorization: `Bearer ${token}` }
     });
@@ -9765,14 +9909,14 @@ async function secretsPreflight(deps, opts) {
 
 // src/secrets-execution.ts
 var import_node_child_process4 = require("node:child_process");
-var import_node_os5 = require("node:os");
+var import_node_os6 = require("node:os");
 init_clean_exit();
 
 // src/gh-create.ts
 var import_promises = require("node:fs/promises");
-var import_node_os4 = require("node:os");
-var import_node_path9 = require("node:path");
-var import_node_crypto5 = require("node:crypto");
+var import_node_os5 = require("node:os");
+var import_node_path10 = require("node:path");
+var import_node_crypto6 = require("node:crypto");
 
 // src/board-priority.ts
 var BOARD_PRIORITY_NAMES = ["Urgent", "High", "Medium", "Low"];
@@ -9858,9 +10002,9 @@ async function bodyArgsViaFile(args, deps = {}) {
   const write = deps.write ?? import_promises.writeFile;
   const remove2 = deps.remove ?? import_promises.unlink;
   const ensureDir = deps.ensureDir ?? import_promises.mkdir;
-  const dir = deps.dir ?? (0, import_node_os4.tmpdir)();
-  const file = (0, import_node_path9.join)(dir, `mmi-gh-body-${process.pid}-${(0, import_node_crypto5.randomBytes)(4).toString("hex")}.md`);
-  await ensureDir((0, import_node_path9.dirname)(file), { recursive: true }).catch(() => {
+  const dir = deps.dir ?? (0, import_node_os5.tmpdir)();
+  const file = (0, import_node_path10.join)(dir, `mmi-gh-body-${process.pid}-${(0, import_node_crypto6.randomBytes)(4).toString("hex")}.md`);
+  await ensureDir((0, import_node_path10.dirname)(file), { recursive: true }).catch(() => {
   });
   await write(file, args[i + 1], "utf8");
   return {
@@ -10188,8 +10332,8 @@ async function defaultRestCreatePr(exec2, input, deps = {}) {
   const write = deps.write ?? import_promises.writeFile;
   const remove2 = deps.remove ?? import_promises.unlink;
   const ensureDir = deps.ensureDir ?? import_promises.mkdir;
-  const dir = deps.dir ?? (0, import_node_os4.tmpdir)();
-  const file = (0, import_node_path9.join)(dir, `mmi-rest-pr-${process.pid}-${(0, import_node_crypto5.randomBytes)(4).toString("hex")}.json`);
+  const dir = deps.dir ?? (0, import_node_os5.tmpdir)();
+  const file = (0, import_node_path10.join)(dir, `mmi-rest-pr-${process.pid}-${(0, import_node_crypto6.randomBytes)(4).toString("hex")}.json`);
   const payload = {
     title: input.title,
     head: input.head,
@@ -10197,7 +10341,7 @@ async function defaultRestCreatePr(exec2, input, deps = {}) {
   };
   if (input.base) payload.base = input.base;
   if (input.draft) payload.draft = true;
-  await ensureDir((0, import_node_path9.dirname)(file), { recursive: true }).catch(() => {
+  await ensureDir((0, import_node_path10.dirname)(file), { recursive: true }).catch(() => {
   });
   await write(file, JSON.stringify(payload), "utf8");
   const args = [
@@ -11133,7 +11277,7 @@ function resolveSpawnTarget(command, args, platform2 = process.platform) {
 }
 function spawnExitCode(status, signal) {
   if (status != null) return status;
-  const signo = signal ? import_node_os5.constants.signals[signal] : void 0;
+  const signo = signal ? import_node_os6.constants.signals[signal] : void 0;
   return signo ? 128 + signo : 1;
 }
 function defaultSpawn(command, args, env) {
@@ -11589,14 +11733,14 @@ function findDuplicateLesson(source, openLessons) {
 }
 
 // src/session-identity.ts
-var import_node_crypto6 = require("node:crypto");
-var import_node_os8 = require("node:os");
+var import_node_crypto7 = require("node:crypto");
+var import_node_os9 = require("node:os");
 
 // src/plugin-guard-io.ts
-var import_node_fs12 = require("node:fs");
+var import_node_fs13 = require("node:fs");
 var import_node_child_process5 = require("node:child_process");
-var import_node_path10 = require("node:path");
-var import_node_os7 = require("node:os");
+var import_node_path11 = require("node:path");
+var import_node_os8 = require("node:os");
 
 // src/marketplace-autoupdate.ts
 var KNOWN_MARKETPLACES_RELATIVE = [".claude", "plugins", "known_marketplaces.json"];
@@ -11740,8 +11884,8 @@ function buildPluginGuardLine(state, opts = {}) {
 }
 
 // src/host-doc-lock.ts
-var import_node_fs11 = require("node:fs");
-var import_node_os6 = require("node:os");
+var import_node_fs12 = require("node:fs");
+var import_node_os7 = require("node:os");
 var SHARED_DOC_LOCK_STALE_MS = 3e4;
 var SHARED_DOC_LOCK_ATTEMPTS = 50;
 var SHARED_DOC_LOCK_INTERVAL_MS = 100;
@@ -11754,7 +11898,7 @@ function lockContent(options) {
 }
 function readHolder(lockPath) {
   try {
-    const parsed = JSON.parse((0, import_node_fs11.readFileSync)(lockPath, "utf8"));
+    const parsed = JSON.parse((0, import_node_fs12.readFileSync)(lockPath, "utf8"));
     if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) return null;
     return parsed;
   } catch {
@@ -11766,7 +11910,7 @@ function lockAgeMs(lockPath, now) {
   const declared = typeof holder?.acquiredAt === "string" ? Date.parse(holder.acquiredAt) : Number.NaN;
   if (!Number.isNaN(declared)) return Math.max(0, now - declared);
   try {
-    return Math.max(0, now - (0, import_node_fs11.statSync)(lockPath).mtimeMs);
+    return Math.max(0, now - (0, import_node_fs12.statSync)(lockPath).mtimeMs);
   } catch {
     return 0;
   }
@@ -11781,7 +11925,7 @@ function acquireSharedDocLock(documentPath, options) {
   const staleAfterMs = options.staleAfterMs ?? SHARED_DOC_LOCK_STALE_MS;
   const attempts = options.attempts ?? SHARED_DOC_LOCK_ATTEMPTS;
   const intervalMs = options.intervalMs ?? SHARED_DOC_LOCK_INTERVAL_MS;
-  const identity = { owner: options.owner, pid: process.pid, host: options.host ?? (0, import_node_os6.hostname)(), acquiredAt: (/* @__PURE__ */ new Date()).toISOString() };
+  const identity = { owner: options.owner, pid: process.pid, host: options.host ?? (0, import_node_os7.hostname)(), acquiredAt: (/* @__PURE__ */ new Date()).toISOString() };
   const content = lockContent(identity);
   const sleep2 = (ms) => {
     Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
@@ -11789,9 +11933,9 @@ function acquireSharedDocLock(documentPath, options) {
   for (let attempt = 0; attempt < attempts; attempt += 1) {
     let fd;
     try {
-      fd = (0, import_node_fs11.openSync)(lockPath, "wx");
-      (0, import_node_fs11.writeSync)(fd, content);
-      (0, import_node_fs11.closeSync)(fd);
+      fd = (0, import_node_fs12.openSync)(lockPath, "wx");
+      (0, import_node_fs12.writeSync)(fd, content);
+      (0, import_node_fs12.closeSync)(fd);
       return {
         documentPath,
         lockPath,
@@ -11804,11 +11948,11 @@ function acquireSharedDocLock(documentPath, options) {
     } catch (error) {
       if (fd !== void 0) {
         try {
-          (0, import_node_fs11.closeSync)(fd);
+          (0, import_node_fs12.closeSync)(fd);
         } catch {
         }
         try {
-          (0, import_node_fs11.unlinkSync)(lockPath);
+          (0, import_node_fs12.unlinkSync)(lockPath);
         } catch {
         }
       }
@@ -11817,12 +11961,12 @@ function acquireSharedDocLock(documentPath, options) {
     if (lockAgeMs(lockPath, Date.now()) >= staleAfterMs) {
       const aside = `${lockPath}.stale-${Date.now()}`;
       try {
-        (0, import_node_fs11.renameSync)(lockPath, aside);
+        (0, import_node_fs12.renameSync)(lockPath, aside);
       } catch {
         continue;
       }
       try {
-        (0, import_node_fs11.rmSync)(aside, { force: true });
+        (0, import_node_fs12.rmSync)(aside, { force: true });
       } catch {
       }
       continue;
@@ -11835,7 +11979,7 @@ function releaseSharedDocLock(handle) {
   try {
     const holder = readHolder(handle.lockPath);
     if (holder && holder.owner === handle.owner && Number(holder.pid) === handle.pid) {
-      (0, import_node_fs11.unlinkSync)(handle.lockPath);
+      (0, import_node_fs12.unlinkSync)(handle.lockPath);
     }
   } catch {
   }
@@ -11982,25 +12126,25 @@ function runHostBin(bin, args, opts) {
   const argv = isWin ? ["/c", bin, ...args] : args;
   return step ? execFileHard(file, argv, { ...shared, step }) : execFileP(file, argv, shared);
 }
-function hermesConfigRoot(env = process.env, home = (0, import_node_os7.homedir)(), platform2 = process.platform) {
+function hermesConfigRoot(env = process.env, home = (0, import_node_os8.homedir)(), platform2 = process.platform) {
   if (env.HERMES_HOME?.trim()) return env.HERMES_HOME.trim();
-  if (platform2 === "win32") return (0, import_node_path10.join)(env.LOCALAPPDATA?.trim() || (0, import_node_path10.join)(home, "AppData", "Local"), "hermes");
-  return (0, import_node_path10.join)(home, ".hermes");
+  if (platform2 === "win32") return (0, import_node_path11.join)(env.LOCALAPPDATA?.trim() || (0, import_node_path11.join)(home, "AppData", "Local"), "hermes");
+  return (0, import_node_path11.join)(home, ".hermes");
 }
-function surfaceConfigRoot(surface, env = process.env, home = (0, import_node_os7.homedir)()) {
-  if (surface === "codex") return env.CODEX_HOME?.trim() || (0, import_node_path10.join)(home, ".codex");
+function surfaceConfigRoot(surface, env = process.env, home = (0, import_node_os8.homedir)()) {
+  if (surface === "codex") return env.CODEX_HOME?.trim() || (0, import_node_path11.join)(home, ".codex");
   if (surface === "hermes") return hermesConfigRoot(env, home);
   if (surface === "jervcode") {
-    return env.JERVCODE_CODING_AGENT_DIR?.trim() || env.PI_CODING_AGENT_DIR?.trim() || (0, import_node_path10.join)(home, ".jerv", "agent");
+    return env.JERVCODE_CODING_AGENT_DIR?.trim() || env.PI_CODING_AGENT_DIR?.trim() || (0, import_node_path11.join)(home, ".jerv", "agent");
   }
-  return (0, import_node_path10.join)(home, ".claude");
+  return (0, import_node_path11.join)(home, ".claude");
 }
 var installedPluginsPath = (surface = detectSurface(process.env)) => {
-  return (0, import_node_path10.join)(surfaceConfigRoot(surface), "plugins", "installed_plugins.json");
+  return (0, import_node_path11.join)(surfaceConfigRoot(surface), "plugins", "installed_plugins.json");
 };
 function readInstalledPlugins(surface = detectSurface(process.env)) {
   try {
-    return JSON.parse((0, import_node_fs12.readFileSync)(installedPluginsPath(surface), "utf8"));
+    return JSON.parse((0, import_node_fs13.readFileSync)(installedPluginsPath(surface), "utf8"));
   } catch {
     return null;
   }
@@ -12009,15 +12153,15 @@ function marketplaceCloneCandidates(surface, home, env = process.env) {
   if (surface === "codex") {
     const root = surfaceConfigRoot(surface, env, home);
     return [
-      (0, import_node_path10.join)(root, ".tmp", "marketplaces", CODEX_MARKETPLACE),
-      (0, import_node_path10.join)(root, "plugins", "marketplaces", CODEX_MARKETPLACE)
+      (0, import_node_path11.join)(root, ".tmp", "marketplaces", CODEX_MARKETPLACE),
+      (0, import_node_path11.join)(root, "plugins", "marketplaces", CODEX_MARKETPLACE)
     ];
   }
   if (surface === "hermes") return [];
   if (surface === "jervcode") return [];
-  return [(0, import_node_path10.join)(home, ".claude", "plugins", "marketplaces", "mutmutco")];
+  return [(0, import_node_path11.join)(home, ".claude", "plugins", "marketplaces", "mutmutco")];
 }
-function marketplaceClonePresent(surface, home, exists = import_node_fs12.existsSync, env = process.env) {
+function marketplaceClonePresent(surface, home, exists = import_node_fs13.existsSync, env = process.env) {
   return marketplaceCloneCandidates(surface, home, env).some(exists);
 }
 function runHostBinSync(bin, args) {
@@ -12059,26 +12203,26 @@ async function fetchNpmReleasedVersion() {
   }
 }
 var JERVCODE_NPM_PACKAGE = "@mutmutco/pi-plugin";
-function jervcodeAgentDirs(env = process.env, home = (0, import_node_os7.homedir)()) {
+function jervcodeAgentDirs(env = process.env, home = (0, import_node_os8.homedir)()) {
   const primary = surfaceConfigRoot("jervcode", env, home);
-  const legacy = (0, import_node_path10.join)(home, ".pi", "agent");
+  const legacy = (0, import_node_path11.join)(home, ".pi", "agent");
   const dirs = [primary];
   if (legacy !== primary) dirs.push(legacy);
-  return dirs.filter((dir) => (0, import_node_fs12.existsSync)(dir));
+  return dirs.filter((dir) => (0, import_node_fs13.existsSync)(dir));
 }
 function readPiSettings(path2) {
-  if (!(0, import_node_fs12.existsSync)(path2)) return void 0;
+  if (!(0, import_node_fs13.existsSync)(path2)) return void 0;
   try {
-    const parsed = JSON.parse((0, import_node_fs12.readFileSync)(path2, "utf8"));
+    const parsed = JSON.parse((0, import_node_fs13.readFileSync)(path2, "utf8"));
     if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return null;
     return parsed;
   } catch {
     return null;
   }
 }
-function mmiPiPackageEntry(env = process.env, home = (0, import_node_os7.homedir)()) {
+function mmiPiPackageEntry(env = process.env, home = (0, import_node_os8.homedir)()) {
   for (const dir of jervcodeAgentDirs(env, home)) {
-    const settings = readPiSettings((0, import_node_path10.join)(dir, "settings.json"));
+    const settings = readPiSettings((0, import_node_path11.join)(dir, "settings.json"));
     const entries = Array.isArray(settings?.packages) ? settings.packages : [];
     for (const entry of entries) {
       if (typeof entry !== "string") continue;
@@ -12088,10 +12232,10 @@ function mmiPiPackageEntry(env = process.env, home = (0, import_node_os7.homedir
   return null;
 }
 var LEGACY_MMI_PI_PATH = /[/\\]mutmutco[/\\]mmi[/\\]\d+\.\d+\.\d+[/\\]\.pi-plugin[/\\]?$/i;
-function legacyMmiPiPathEntries(env = process.env, home = (0, import_node_os7.homedir)()) {
+function legacyMmiPiPathEntries(env = process.env, home = (0, import_node_os8.homedir)()) {
   const found = [];
   for (const dir of jervcodeAgentDirs(env, home)) {
-    const settings = readPiSettings((0, import_node_path10.join)(dir, "settings.json"));
+    const settings = readPiSettings((0, import_node_path11.join)(dir, "settings.json"));
     const entries = Array.isArray(settings?.packages) ? settings.packages : [];
     for (const entry of entries) {
       if (typeof entry === "string" && LEGACY_MMI_PI_PATH.test(entry) && !found.includes(entry)) found.push(entry);
@@ -12099,37 +12243,37 @@ function legacyMmiPiPathEntries(env = process.env, home = (0, import_node_os7.ho
   }
   return found;
 }
-function mmiPiPackageRoot(env = process.env, home = (0, import_node_os7.homedir)()) {
+function mmiPiPackageRoot(env = process.env, home = (0, import_node_os8.homedir)()) {
   for (const dir of jervcodeAgentDirs(env, home)) {
-    const root = (0, import_node_path10.join)(dir, "npm", "node_modules", ...JERVCODE_NPM_PACKAGE.split("/"));
-    if ((0, import_node_fs12.existsSync)((0, import_node_path10.join)(root, "package.json"))) return root;
+    const root = (0, import_node_path11.join)(dir, "npm", "node_modules", ...JERVCODE_NPM_PACKAGE.split("/"));
+    if ((0, import_node_fs13.existsSync)((0, import_node_path11.join)(root, "package.json"))) return root;
   }
   return null;
 }
-function installedJervCodePackageVersion(env = process.env, home = (0, import_node_os7.homedir)()) {
+function installedJervCodePackageVersion(env = process.env, home = (0, import_node_os8.homedir)()) {
   const root = mmiPiPackageRoot(env, home);
   if (!root) return void 0;
   try {
-    const manifest = JSON.parse((0, import_node_fs12.readFileSync)((0, import_node_path10.join)(root, "package.json"), "utf8"));
+    const manifest = JSON.parse((0, import_node_fs13.readFileSync)((0, import_node_path11.join)(root, "package.json"), "utf8"));
     return typeof manifest.version === "string" ? manifest.version : void 0;
   } catch {
     return void 0;
   }
 }
-function mmiPiPackageHealthy(env = process.env, home = (0, import_node_os7.homedir)()) {
+function mmiPiPackageHealthy(env = process.env, home = (0, import_node_os8.homedir)()) {
   const root = mmiPiPackageRoot(env, home);
-  return Boolean(root && (0, import_node_fs12.existsSync)((0, import_node_path10.join)(root, "skills", "bootstrap", "SKILL.md")));
+  return Boolean(root && (0, import_node_fs13.existsSync)((0, import_node_path11.join)(root, "skills", "bootstrap", "SKILL.md")));
 }
 function piDoctorEnv(agentDir) {
   return { ...process.env, PI_CODING_AGENT_DIR: agentDir };
 }
-function hermesPluginRoot(env = process.env, home = (0, import_node_os7.homedir)()) {
-  return (0, import_node_path10.join)(hermesConfigRoot(env, home), "plugins", "mmi");
+function hermesPluginRoot(env = process.env, home = (0, import_node_os8.homedir)()) {
+  return (0, import_node_path11.join)(hermesConfigRoot(env, home), "plugins", "mmi");
 }
-function hermesPluginTreeHealthy(root, exists = import_node_fs12.existsSync) {
-  if (!["plugin.yaml", "__init__.py"].every((file) => exists((0, import_node_path10.join)(root, file)))) return false;
+function hermesPluginTreeHealthy(root, exists = import_node_fs13.existsSync) {
+  if (!["plugin.yaml", "__init__.py"].every((file) => exists((0, import_node_path11.join)(root, file)))) return false;
   try {
-    return (0, import_node_fs12.statSync)((0, import_node_path10.join)(root, "skills")).isDirectory();
+    return (0, import_node_fs13.statSync)((0, import_node_path11.join)(root, "skills")).isDirectory();
   } catch {
     return false;
   }
@@ -12144,12 +12288,12 @@ function snapshotPluginGuardInput(surface = detectSurface(process.env), isOrgRep
     // Codex's native projection is authoritative; its legacy installed_plugins.json may be empty
     // while `plugin list --json` proves the managed plugin installed (#6111).
     installRecordPresent: surface === "codex" ? codexStatus?.installed === true : hasUserInstallRecord(installed, MMI_PLUGIN_ID) || hasProjectInstallRecord(installed, MMI_PLUGIN_ID, process.cwd()) || // #4188: jervcode's install record is the settings-file packages[] entry itself.
-    surface === "jervcode" && piEntry !== null || surface === "hermes" && (0, import_node_fs12.existsSync)(hermesPluginRoot()),
+    surface === "jervcode" && piEntry !== null || surface === "hermes" && (0, import_node_fs13.existsSync)(hermesPluginRoot()),
     // JervCode's settings entry and native local surfaces have no marketplace clone.
-    marketplaceClonePresent: surface === "jervcode" || surface === "hermes" ? true : marketplaceClonePresent(surface, (0, import_node_os7.homedir)()),
+    marketplaceClonePresent: surface === "jervcode" || surface === "hermes" ? true : marketplaceClonePresent(surface, (0, import_node_os8.homedir)()),
     pluginCachePresent: surface === "jervcode" ? mmiPiPackageHealthy() : surface === "hermes" ? hermesPluginTreeHealthy(hermesPluginRoot()) : surface === "codex" ? Boolean(
-      codexStatus?.installed && codexStatus.enabled && codexStatus.version && (0, import_node_fs12.existsSync)((0, import_node_path10.join)(root, "plugins", "cache", CODEX_MARKETPLACE, "mmi", codexStatus.version))
-    ) : (0, import_node_fs12.existsSync)((0, import_node_path10.join)(root, "plugins", "cache", "mutmutco", "mmi"))
+      codexStatus?.installed && codexStatus.enabled && codexStatus.version && (0, import_node_fs13.existsSync)((0, import_node_path11.join)(root, "plugins", "cache", CODEX_MARKETPLACE, "mmi", codexStatus.version))
+    ) : (0, import_node_fs13.existsSync)((0, import_node_path11.join)(root, "plugins", "cache", "mutmutco", "mmi"))
   };
 }
 async function runPluginCli(bin, args, log) {
@@ -12196,7 +12340,7 @@ async function runHealSteps(host, tableSteps, deps) {
   const refSupported = needsRefProbe ? await marketplaceAddRefSupported(host) : true;
   const { steps } = adaptHealStepsForRefSupport(tableSteps, refSupported);
   if (deps.banner) log(deps.banner(refSupported));
-  const pinsPath = (0, import_node_path10.join)((0, import_node_os7.homedir)(), ...KNOWN_MARKETPLACES_RELATIVE);
+  const pinsPath = (0, import_node_path11.join)((0, import_node_os8.homedir)(), ...KNOWN_MARKETPLACES_RELATIVE);
   const pins = host === "claude" ? captureMarketplacePins(readKnownMarketplacesFile(pinsPath), [MMI_MARKETPLACE_NAME, JERV_MARKETPLACE_NAME]) : /* @__PURE__ */ new Map();
   let failure;
   try {
@@ -12307,7 +12451,7 @@ async function healActivePluginForDoctor(surface = detectSurface(process.env), o
 }
 function readKnownMarketplacesFile(path2) {
   try {
-    return (0, import_node_fs12.existsSync)(path2) ? (0, import_node_fs12.readFileSync)(path2, "utf8") : void 0;
+    return (0, import_node_fs13.existsSync)(path2) ? (0, import_node_fs13.readFileSync)(path2, "utf8") : void 0;
   } catch {
     return void 0;
   }
@@ -12341,11 +12485,11 @@ function writeMarketplacePinsOnDisk(path2, pins, succeeded, failedVerb, declineW
       if (declined) return declined;
       const tmp = `${path2}.tmp-${process.pid}`;
       try {
-        (0, import_node_fs12.writeFileSync)(tmp, next, "utf8");
-        (0, import_node_fs12.renameSync)(tmp, path2);
+        (0, import_node_fs13.writeFileSync)(tmp, next, "utf8");
+        (0, import_node_fs13.renameSync)(tmp, path2);
       } catch {
         try {
-          (0, import_node_fs12.rmSync)(tmp, { force: true });
+          (0, import_node_fs13.rmSync)(tmp, { force: true });
         } catch {
         }
         return `could NOT ${failedVerb} ${[...pins.keys()].join(", ")} \u2014 set it by hand`;
@@ -12473,7 +12617,7 @@ function readSessionIdSource(env) {
 var synthesizedSessionId;
 function fallbackSessionId(surface) {
   if (!synthesizedSessionId) {
-    synthesizedSessionId = `${SYNTH_SESSION_PREFIX}${surface}-${process.pid}-${(0, import_node_crypto6.randomBytes)(3).toString("hex")}`;
+    synthesizedSessionId = `${SYNTH_SESSION_PREFIX}${surface}-${process.pid}-${(0, import_node_crypto7.randomBytes)(3).toString("hex")}`;
   }
   return synthesizedSessionId;
 }
@@ -12482,7 +12626,7 @@ function describeSessionIdentity(env = process.env) {
   return {
     session: readSessionId(env) ?? fallbackSessionId(surface),
     surface,
-    host: (0, import_node_os8.hostname)()
+    host: (0, import_node_os9.hostname)()
   };
 }
 function formatSessionIdentity(identity) {
@@ -13182,7 +13326,7 @@ function renderBoardSource() {
   return "source: live";
 }
 async function collectBoardPreferringSnapshot(cfg, options, deps) {
-  if (options.snapshotOnly && !deps.snapshot) throw new Error("--snapshot-only needs the Hub snapshot transport (not with --direct)");
+  if (options.snapshotOnly && !deps.snapshot) throw new BoardSnapshotFailure({ ok: false, outcome: "hub-unreachable", reason: "--snapshot-only needs the Hub snapshot transport (not with --direct)" });
   const attempt = deps.snapshot ? await fetchHubBoardSnapshot(
     {
       owner: cfg.projectOwner,
@@ -13195,6 +13339,7 @@ async function collectBoardPreferringSnapshot(cfg, options, deps) {
     deps.snapshot
   ) : void 0;
   if (attempt?.state === "refused") {
+    if (options.snapshotOnly) throw new BoardSnapshotFailure({ ok: false, outcome: "refused", reason: attempt.reason });
     throw new Error(attempt.reason);
   }
   if (attempt?.state === "ok") {
@@ -13224,7 +13369,16 @@ async function collectBoardPreferringSnapshot(cfg, options, deps) {
     };
   }
   if (options.snapshotOnly && attempt?.state === "unavailable") {
-    throw Object.assign(new Error(`Hub board snapshot unavailable (${attempt.reason}) \u2014 --snapshot-only refuses the direct user-auth fallback`), { quota: attempt.quota });
+    throw Object.assign(new BoardSnapshotFailure({
+      ok: false,
+      outcome: attempt.appQuotaExhausted ? "app-quota-exhausted" : "hub-unreachable",
+      reason: `Hub board snapshot unavailable (${attempt.reason}) \u2014 --snapshot-only refuses the direct user-auth fallback`,
+      ...attempt.resetAt ? { resetAt: attempt.resetAt } : {},
+      ...attempt.pool ? { pool: attempt.pool } : {}
+    }), { quota: attempt.quota });
+  }
+  if (attempt?.state === "unavailable" && attempt.appQuotaExhausted) {
+    throw Object.assign(new Error(`Hub board snapshot unavailable (${attempt.reason}) \u2014 the personal-token fallback is refused while the org App allowance is exhausted; retry after the reset`), { quota: attempt.quota });
   }
   const collected = await collectBoardItems(cfg, { repo: options.repo, allowPartial: options.allowPartial, activeOnly: true }, deps);
   if (attempt?.state === "unavailable") {
@@ -13907,7 +14061,7 @@ var CLAIM_SESSION_ACTIVITY_MS = 30 * 6e4;
 var CLAIM_SESSION_PROBE_CACHE_MS = 6e4;
 var claimSessionProbeCache = /* @__PURE__ */ new Map();
 function probeLocalClaimSession(marker, now = Date.now()) {
-  if (!marker.session || !marker.host || marker.host.toLowerCase() !== (0, import_node_os9.hostname)().toLowerCase()) return void 0;
+  if (!marker.session || !marker.host || marker.host.toLowerCase() !== (0, import_node_os10.hostname)().toLowerCase()) return void 0;
   if (!marker.surface?.toLowerCase().startsWith("claude")) return void 0;
   const cacheKey = `${marker.host.toLowerCase()}/${marker.session}`;
   const cached = claimSessionProbeCache.get(cacheKey);
@@ -13916,17 +14070,17 @@ function probeLocalClaimSession(marker, now = Date.now()) {
     claimSessionProbeCache.set(cacheKey, { checkedAt: now, state });
     return state;
   };
-  const root = (0, import_node_path11.join)((0, import_node_os9.homedir)(), ".claude", "projects");
+  const root = (0, import_node_path12.join)((0, import_node_os10.homedir)(), ".claude", "projects");
   try {
     const wanted = `${marker.session}.jsonl`.toLowerCase();
     const pending = [root];
     while (pending.length) {
       const dir = pending.pop();
-      for (const entry of (0, import_node_fs13.readdirSync)(dir, { withFileTypes: true })) {
-        const path2 = (0, import_node_path11.join)(dir, entry.name);
+      for (const entry of (0, import_node_fs14.readdirSync)(dir, { withFileTypes: true })) {
+        const path2 = (0, import_node_path12.join)(dir, entry.name);
         if (entry.isDirectory()) pending.push(path2);
         else if (entry.isFile() && entry.name.toLowerCase() === wanted) {
-          return remember(now - (0, import_node_fs13.statSync)(path2).mtimeMs <= CLAIM_SESSION_ACTIVITY_MS ? "live" : "dead");
+          return remember(now - (0, import_node_fs14.statSync)(path2).mtimeMs <= CLAIM_SESSION_ACTIVITY_MS ? "live" : "dead");
         }
       }
     }
@@ -15179,7 +15333,7 @@ async function propagateMayAutoMerge(repo, repoClass, rest) {
 }
 
 // src/bootstrap-apply.ts
-var import_node_crypto7 = require("node:crypto");
+var import_node_crypto8 = require("node:crypto");
 
 // src/bootstrap-seeds.ts
 var PLACEHOLDER_RE = /\{\{([A-Z0-9_]+)\}\}/g;
@@ -15418,13 +15572,13 @@ function planManagedGitignore(current) {
 }
 
 // src/docs-index-command.ts
-var import_node_fs15 = require("node:fs");
-var import_node_path13 = require("node:path");
+var import_node_fs16 = require("node:fs");
+var import_node_path14 = require("node:path");
 
 // src/doc-refs-core.ts
 var import_node_child_process6 = require("node:child_process");
-var import_node_fs14 = require("node:fs");
-var import_node_path12 = require("node:path");
+var import_node_fs15 = require("node:fs");
+var import_node_path13 = require("node:path");
 var PIN_RE = /<!--\s*pinned by\s+([^:]+?)\s*:\s*"([^"]+)"[^"]*-->/;
 var PIN_MENTION_RE = /<!--\s*pinned by\b/;
 var FWD_RE = /<!--\s*forward-ref:\s*(\S+?)\s*-->/;
@@ -15483,7 +15637,7 @@ function checkPins(root, readFile10, docs) {
         findings.push({ kind: "malformed-pin", doc, line: pin.line, detail: pin.text });
         continue;
       }
-      const source = readFile10((0, import_node_path12.join)(root, pin.file));
+      const source = readFile10((0, import_node_path13.join)(root, pin.file));
       if (source == null) {
         findings.push({ kind: "missing-test", doc, line: pin.line, detail: pin.file });
         continue;
@@ -15546,11 +15700,11 @@ function checkRefs(root, deps, docs) {
     for (const { ref } of extractRefs(markdown)) allFirstSegments.add(refFirstSegment(ref));
   }
   const tracked = allFirstSegments.size ? deps.trackedFirstSegments?.([...allFirstSegments]) ?? null : null;
-  const firstVerifiable = (first) => tracked ? tracked.has(first) : exists((0, import_node_path12.join)(root, first));
+  const firstVerifiable = (first) => tracked ? tracked.has(first) : exists((0, import_node_path13.join)(root, first));
   const candidates = [];
   const direct = [];
   for (const [doc, markdown] of Object.entries(docs)) {
-    const docDir = import_node_path12.posix.dirname(doc);
+    const docDir = import_node_path13.posix.dirname(doc);
     const base = docDir === "." ? "" : docDir;
     const covered = /* @__PURE__ */ new Set();
     const markers = [];
@@ -15559,21 +15713,21 @@ function checkRefs(root, deps, docs) {
         direct.push({ kind: "malformed-forward-ref", doc, line: fwd.line, detail: fwd.text });
         continue;
       }
-      const docRel = import_node_path12.posix.normalize(import_node_path12.posix.join(base, fwd.target));
-      const rootRel = import_node_path12.posix.normalize(fwd.target.replace(/^\/+/, ""));
+      const docRel = import_node_path13.posix.normalize(import_node_path13.posix.join(base, fwd.target));
+      const rootRel = import_node_path13.posix.normalize(fwd.target.replace(/^\/+/, ""));
       markers.push({ target: fwd.target, line: fwd.line, docRel, rootRel });
       covered.add(docRel);
       covered.add(rootRel);
     }
     const links = extractLinks(markdown).map(({ target, line }) => {
-      const resolved = import_node_path12.posix.normalize(import_node_path12.posix.join(base, target));
-      return { target, line, resolved, missing: !exists((0, import_node_path12.join)(root, resolved)) };
+      const resolved = import_node_path13.posix.normalize(import_node_path13.posix.join(base, target));
+      return { target, line, resolved, missing: !exists((0, import_node_path13.join)(root, resolved)) };
     });
     for (const marker of markers) {
       const coversMissing = links.some(
         (l) => l.missing && (l.resolved === marker.docRel || l.resolved === marker.rootRel)
       );
-      if (!coversMissing && (exists((0, import_node_path12.join)(root, marker.docRel)) || exists((0, import_node_path12.join)(root, marker.rootRel)))) {
+      if (!coversMissing && (exists((0, import_node_path13.join)(root, marker.docRel)) || exists((0, import_node_path13.join)(root, marker.rootRel)))) {
         direct.push({
           kind: "stale-forward-ref",
           doc,
@@ -15584,7 +15738,7 @@ function checkRefs(root, deps, docs) {
     }
     for (const { ref, line } of extractRefs(markdown)) {
       if (!firstVerifiable(refFirstSegment(ref))) continue;
-      if (!exists((0, import_node_path12.join)(root, ref))) candidates.push({ kind: "missing-path", doc, line, detail: ref });
+      if (!exists((0, import_node_path13.join)(root, ref))) candidates.push({ kind: "missing-path", doc, line, detail: ref });
     }
     for (const { target, line, resolved, missing } of links) {
       if (resolved.startsWith("..")) {
@@ -15632,24 +15786,24 @@ function checkCommands(docs, commandPaths) {
   return { ok: findings.length === 0, findings, warnings: [] };
 }
 function readFileOrNull(path2) {
-  return (0, import_node_fs14.existsSync)(path2) ? (0, import_node_fs14.readFileSync)(path2, "utf8") : null;
+  return (0, import_node_fs15.existsSync)(path2) ? (0, import_node_fs15.readFileSync)(path2, "utf8") : null;
 }
 function walk(dir, root, out) {
-  for (const entry of (0, import_node_fs14.readdirSync)(dir)) {
-    const full = (0, import_node_path12.join)(dir, entry);
-    if ((0, import_node_fs14.statSync)(full).isDirectory()) walk(full, root, out);
+  for (const entry of (0, import_node_fs15.readdirSync)(dir)) {
+    const full = (0, import_node_path13.join)(dir, entry);
+    if ((0, import_node_fs15.statSync)(full).isDirectory()) walk(full, root, out);
     else if (entry.endsWith(".md")) out.push(full.slice(root.length + 1).replaceAll("\\", "/"));
   }
   return out;
 }
 function defaultListDocs(root) {
   const docs = ["docs", "skills/org-guide", "skills/mmi-help"].flatMap((path2) => {
-    const directory = (0, import_node_path12.join)(root, path2);
-    return (0, import_node_fs14.existsSync)(directory) ? walk(directory, root, []) : [];
+    const directory = (0, import_node_path13.join)(root, path2);
+    return (0, import_node_fs15.existsSync)(directory) ? walk(directory, root, []) : [];
   }).filter(
     (rel) => !SKIP_WALK.some((skip) => rel.startsWith(skip))
   );
-  return [...ROOT_DOCS.filter((rel) => (0, import_node_fs14.existsSync)((0, import_node_path12.join)(root, rel))), ...docs];
+  return [...ROOT_DOCS.filter((rel) => (0, import_node_fs15.existsSync)((0, import_node_path13.join)(root, rel))), ...docs];
 }
 var CHECK_IGNORE_MAX_BUFFER = 32 * 1024 * 1024;
 function defaultIsIgnored(root, relPaths, exec2 = import_node_child_process6.execFileSync) {
@@ -15701,7 +15855,7 @@ function defaultTrackedFirstSegments(root, firstSegments, exec2 = import_node_ch
 }
 function runDocRefs(root, deps = {}) {
   const readFile10 = deps.readFile ?? readFileOrNull;
-  const exists = deps.exists ?? import_node_fs14.existsSync;
+  const exists = deps.exists ?? import_node_fs15.existsSync;
   const listDocs = deps.listDocs ?? defaultListDocs;
   const isIgnored = deps.isIgnored ?? ((paths) => defaultIsIgnored(root, paths));
   const trackedFirstSegments = deps.trackedFirstSegments ?? ((segs) => defaultTrackedFirstSegments(root, segs));
@@ -15709,7 +15863,7 @@ function runDocRefs(root, deps = {}) {
   const walked = listDocs(root);
   const ignoredDocs = walked.length ? isIgnored(walked) : /* @__PURE__ */ new Set();
   const docs = Object.fromEntries(
-    walked.filter((rel) => !ignoredDocs.has(rel)).map((rel) => [rel, readFile10((0, import_node_path12.join)(root, rel))]).filter(([, body]) => body != null)
+    walked.filter((rel) => !ignoredDocs.has(rel)).map((rel) => [rel, readFile10((0, import_node_path13.join)(root, rel))]).filter(([, body]) => body != null)
   );
   const refResult = checkRefs(root, { exists, isIgnored, trackedFirstSegments }, docs);
   const findings = [
@@ -15816,31 +15970,31 @@ function walkMarkdown(dir) {
   const stack = [dir];
   while (stack.length) {
     const current = stack.pop();
-    for (const entry of (0, import_node_fs15.readdirSync)(current, { withFileTypes: true })) {
-      const full = (0, import_node_path13.join)(current, entry.name);
+    for (const entry of (0, import_node_fs16.readdirSync)(current, { withFileTypes: true })) {
+      const full = (0, import_node_path14.join)(current, entry.name);
       if (entry.isDirectory()) {
         stack.push(full);
       } else if (entry.isFile() && entry.name.endsWith(".md")) {
-        out.push((0, import_node_path13.relative)(dir, full).split(import_node_path13.sep).join("/"));
+        out.push((0, import_node_path14.relative)(dir, full).split(import_node_path14.sep).join("/"));
       }
     }
   }
   return out;
 }
 function createDocsIndexDeps(repoRoot2) {
-  const docsDir = (0, import_node_path13.join)(repoRoot2, "docs");
-  const indexPath = (0, import_node_path13.join)(repoRoot2, DOCS_INDEX_PATH);
+  const docsDir = (0, import_node_path14.join)(repoRoot2, "docs");
+  const indexPath = (0, import_node_path14.join)(repoRoot2, DOCS_INDEX_PATH);
   return {
     listDocs: () => {
-      if (!(0, import_node_fs15.existsSync)(docsDir)) return [];
+      if (!(0, import_node_fs16.existsSync)(docsDir)) return [];
       const walked = walkMarkdown(docsDir).filter(isRoutableDocsPath);
       if (!walked.length) return [];
       const ignored = defaultIsIgnored(repoRoot2, walked.map((rel) => `docs/${rel}`));
       return walked.filter((rel) => !ignored.has(`docs/${rel}`)).sort();
     },
-    readDoc: (relPath) => (0, import_node_fs15.readFileSync)((0, import_node_path13.join)(docsDir, relPath), "utf8"),
-    readIndex: () => (0, import_node_fs15.existsSync)(indexPath) ? (0, import_node_fs15.readFileSync)(indexPath, "utf8") : null,
-    writeIndex: (content) => (0, import_node_fs15.writeFileSync)(indexPath, content, "utf8")
+    readDoc: (relPath) => (0, import_node_fs16.readFileSync)((0, import_node_path14.join)(docsDir, relPath), "utf8"),
+    readIndex: () => (0, import_node_fs16.existsSync)(indexPath) ? (0, import_node_fs16.readFileSync)(indexPath, "utf8") : null,
+    writeIndex: (content) => (0, import_node_fs16.writeFileSync)(indexPath, content, "utf8")
   };
 }
 
@@ -16446,7 +16600,7 @@ function planSeedAction(seed, exists) {
   return exists ? { target: seed.target, action: "update", ownership: "org", reason: "org-owned, refresh to current" } : { target: seed.target, action: "create", ownership: "org", reason: "org-owned, missing" };
 }
 var GATE_RENDER_NOTE = "# Rendered from the registry gate config by mmi-cli devops bootstrap apply <repo> --only gate.yml --from-config; edit the config, not this file.\n";
-var gateHash = (body) => (0, import_node_crypto7.createHash)("sha256").update(body, "utf8").digest("hex");
+var gateHash = (body) => (0, import_node_crypto8.createHash)("sha256").update(body, "utf8").digest("hex");
 function parseGateRenderStamp(content) {
   const match = /^# mmi-gate-render: sha256=([a-f0-9]{64})\n/.exec(content);
   return match ? { hash: match[1], body: content.slice(match[0].length) } : null;
@@ -16753,8 +16907,8 @@ function contentPutInputArgs(repo, path2, inputFile) {
 }
 
 // src/train-apply-contracts.ts
-var import_node_fs16 = require("node:fs");
-var import_node_path14 = require("node:path");
+var import_node_fs17 = require("node:fs");
+var import_node_path15 = require("node:path");
 function reduceFollowUpOutcomes(outcomes) {
   if (outcomes.includes("failure")) return "failure";
   if (outcomes.includes("unresolved")) return "unresolved";
@@ -16834,7 +16988,7 @@ async function resolveFoldPaths(deps, model) {
   if (model === "vercel") return [];
   const helper = "scripts/release-distribution.mjs";
   if (model === "hub-serverless" || model === "registry-publish") {
-    if ((0, import_node_fs16.existsSync)(helper)) {
+    if ((0, import_node_fs17.existsSync)(helper)) {
       let out;
       try {
         out = await deps.run("node", [helper, "changed-files"]);
@@ -16973,7 +17127,7 @@ async function restoreMainNpmPackIdentities(deps, version) {
   if (mainBom.version !== version) return void 0;
   let localBom;
   try {
-    localBom = JSON.parse((0, import_node_fs16.readFileSync)(bomPath, "utf8"));
+    localBom = JSON.parse((0, import_node_fs17.readFileSync)(bomPath, "utf8"));
   } catch (e) {
     throw new Error(
       `version fold refused: ${bomPath} written by this fold's prepare is unreadable (${describeReadError(e)}) \u2014 cannot restore the published ${version} npm-pack identities from origin/main (#4503/#4713).`
@@ -16991,14 +17145,14 @@ async function restoreMainNpmPackIdentities(deps, version) {
     restored += 1;
   }
   if (restored === 0) return void 0;
-  (0, import_node_fs16.writeFileSync)(bomPath, `${JSON.stringify(localBom, null, 2)}
+  (0, import_node_fs17.writeFileSync)(bomPath, `${JSON.stringify(localBom, null, 2)}
 `);
   return `restored ${restored} npm-pack BOM identit${restored === 1 ? "y" : "ies"} from origin/main (#4503)`;
 }
 function publishVisibilityFor(surfaceId) {
   let raw;
   try {
-    raw = (0, import_node_fs16.readFileSync)("surfaces.json", "utf8");
+    raw = (0, import_node_fs17.readFileSync)("surfaces.json", "utf8");
   } catch (e) {
     if (e.code === "ENOENT") return "unknown";
     throw trainReadFailure(
@@ -17019,7 +17173,7 @@ function publishVisibilityFor(surfaceId) {
 }
 function npmPackArtifactName(packagePath) {
   try {
-    const pkg = JSON.parse((0, import_node_fs16.readFileSync)((0, import_node_path14.join)(packagePath, "package.json"), "utf8"));
+    const pkg = JSON.parse((0, import_node_fs17.readFileSync)((0, import_node_path15.join)(packagePath, "package.json"), "utf8"));
     return pkg.name || void 0;
   } catch {
     return void 0;
@@ -17028,7 +17182,7 @@ function npmPackArtifactName(packagePath) {
 async function refuseDivergentPublishedNpmPack(deps, version) {
   let localBom;
   try {
-    localBom = JSON.parse((0, import_node_fs16.readFileSync)("distribution-bom.json", "utf8"));
+    localBom = JSON.parse((0, import_node_fs17.readFileSync)("distribution-bom.json", "utf8"));
   } catch (e) {
     throw new Error(
       `version fold refused: distribution-bom.json written by this fold's prepare is unreadable (${e instanceof Error ? e.message.split("\n")[0] : String(e)}) \u2014 cannot compare the same-PATCH ${version} npm-pack identities against published npm (#4503/#4662).`
@@ -17173,8 +17327,8 @@ function assertGitBashOnWindowsForJervHubRelease(repo, platform2 = process.platf
 }
 
 // src/train-apply-correlation.ts
-var import_node_fs18 = require("node:fs");
-var import_node_path16 = require("node:path");
+var import_node_fs19 = require("node:fs");
+var import_node_path17 = require("node:path");
 
 // src/fleet-lockstep-enforce.ts
 init_github_client();
@@ -17939,10 +18093,10 @@ var rollout_plan_default = {
     note: "The v4.0.0 stamp happens at cut time (D6e #4463); until then the candidate is the origin/development head artifacts (built cli/dist + npm pack), identity proven by dist content hash (D6a)."
   },
   baseline: {
-    version: "4.5.117",
-    tag: "v4.5.117",
-    commit: "8ec1a0aa6b67",
-    npm: "@mutmutco/cli@4.5.117"
+    version: "4.5.119",
+    tag: "v4.5.119",
+    commit: "1682b1bdb4b1",
+    npm: "@mutmutco/cli@4.5.119"
   },
   exitCriterion: "fleet-n-of-n",
   hubOnlyShortcut: "forbidden",
@@ -17959,14 +18113,14 @@ var rollout_plan_default = {
           repo: "mutmutco/mmi-hub",
           role: "canary",
           schedule: "train",
-          v3Target: "v4.5.117"
+          v3Target: "v4.5.119"
         }
       ],
       rollbackTrigger: "Any red inside the post-contract soak window: `devops train gate` FAIL attributable to the v4 doors, Hub endpoint health probe failure, a pre-v4 client admitted instead of receiving actionable HTTP 426, or npm consumer install/doctor failure on the v4-only dist.",
       rollback: {
         independent: true,
-        mechanism: "npm dist-tag latest -> 4.5.117 and redeploy the Hub Lambda from tag v4.5.117 (8ec1a0aa6b67); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
-        v3Target: "v4.5.117 (@mutmutco/cli@4.5.117, tag commit 8ec1a0aa6b67 \u2014 last known-good release carrying the repo-index v4-only contract)"
+        mechanism: "npm dist-tag latest -> 4.5.119 and redeploy the Hub Lambda from tag v4.5.119 (1682b1bdb4b1); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
+        v3Target: "v4.5.119 (@mutmutco/cli@4.5.119, tag commit 1682b1bdb4b1 \u2014 last known-good release carrying the repo-index v4-only contract)"
       }
     },
     {
@@ -18300,13 +18454,13 @@ function resolveIssueViewGhFields(normalized) {
 }
 
 // src/utf8-receipt.ts
-var import_node_fs17 = require("node:fs");
-var import_node_path15 = require("node:path");
+var import_node_fs18 = require("node:fs");
+var import_node_path16 = require("node:path");
 function writeUtf8Receipt(path2, text) {
-  (0, import_node_fs17.mkdirSync)((0, import_node_path15.dirname)(path2), { recursive: true });
+  (0, import_node_fs18.mkdirSync)((0, import_node_path16.dirname)(path2), { recursive: true });
   const body = text.endsWith("\n") ? text : `${text}
 `;
-  (0, import_node_fs17.writeFileSync)(path2, body, "utf8");
+  (0, import_node_fs18.writeFileSync)(path2, body, "utf8");
   return Buffer.byteLength(body, "utf8");
 }
 
@@ -20174,7 +20328,7 @@ function resolveReleaseAbortNpmPackage(meta, repo) {
   if (isHubControlRepo(repo)) return "@mutmutco/cli";
   const publishDir = typeof meta.publishDir === "string" && meta.publishDir.trim() ? meta.publishDir.trim() : ".";
   try {
-    const pkg = JSON.parse((0, import_node_fs18.readFileSync)((0, import_node_path16.join)(publishDir, "package.json"), "utf8"));
+    const pkg = JSON.parse((0, import_node_fs19.readFileSync)((0, import_node_path17.join)(publishDir, "package.json"), "utf8"));
     const name = pkg.name?.trim();
     if (!name) throw new Error("missing name field");
     return name;
@@ -21102,9 +21256,9 @@ function parseVerifyBroker(stdout) {
 }
 
 // src/train-apply-deploy.ts
-var import_node_fs19 = require("node:fs");
-var import_node_os10 = require("node:os");
-var import_node_path17 = require("node:path");
+var import_node_fs20 = require("node:fs");
+var import_node_os11 = require("node:os");
+var import_node_path18 = require("node:path");
 
 // src/vercel-deployments.ts
 var TERMINAL = /* @__PURE__ */ new Set(["success", "failure", "error", "inactive"]);
@@ -21243,7 +21397,7 @@ function mmiGetRedeployCommand(repo) {
 }
 function readLocalLauncherVersion(root = process.cwd()) {
   try {
-    const raw = (0, import_node_fs19.readFileSync)((0, import_node_path17.join)(root, "cli", "package.json"), "utf8");
+    const raw = (0, import_node_fs20.readFileSync)((0, import_node_path18.join)(root, "cli", "package.json"), "utf8");
     const version = JSON.parse(raw).version;
     return typeof version === "string" && version.trim() ? version.trim() : null;
   } catch {
@@ -21252,7 +21406,7 @@ function readLocalLauncherVersion(root = process.cwd()) {
 }
 function readServedChannelUrl(product = HUB_SERVED_PRODUCT, root = process.cwd()) {
   try {
-    const raw = (0, import_node_fs19.readFileSync)((0, import_node_path17.join)(root, "config", `product.${product}.json`), "utf8");
+    const raw = (0, import_node_fs20.readFileSync)((0, import_node_path18.join)(root, "config", `product.${product}.json`), "utf8");
     const host = JSON.parse(raw).host;
     if (typeof host !== "string" || !host.trim()) return null;
     return `${host.trim().replace(/\/+$/, "")}/release/version`;
@@ -21686,13 +21840,13 @@ async function runTaggedJervGatewayLocalWrapper(deps, tag, tagSha) {
     const reason = error instanceof Error ? error.message : String(error);
     throw new Error(`could not extract ${JERV_GATEWAY_RELEASE_DEPLOY_SCRIPT} from tagged commit ${tagSha.slice(0, 12)}: ${reason}`);
   }
-  const dir = (0, import_node_fs19.mkdtempSync)((0, import_node_path17.join)((0, import_node_os10.tmpdir)(), "jerv-gateway-release-deploy-"));
-  const extracted = (0, import_node_path17.join)(dir, "jerv-gateway-release-deploy.sh");
+  const dir = (0, import_node_fs20.mkdtempSync)((0, import_node_path18.join)((0, import_node_os11.tmpdir)(), "jerv-gateway-release-deploy-"));
+  const extracted = (0, import_node_path18.join)(dir, "jerv-gateway-release-deploy.sh");
   try {
-    (0, import_node_fs19.writeFileSync)(extracted, script, "utf8");
+    (0, import_node_fs20.writeFileSync)(extracted, script, "utf8");
     return await deps.run("bash", [extracted, "--tag", tag]);
   } finally {
-    (0, import_node_fs19.rmSync)(dir, { recursive: true, force: true });
+    (0, import_node_fs20.rmSync)(dir, { recursive: true, force: true });
   }
 }
 async function appendJervGatewayReleaseDeploy(deps, repo, tag, tagSha, dispatch) {
@@ -22158,28 +22312,46 @@ async function runTenantControl(deps, options) {
   const watch = options.watch ?? tenantControlWatches(action);
   const base = { command: "tenant-control", repo, stage, action };
   const since = (deps.now ?? Date.now)();
-  const d = await deps.dispatchTenantControl({ repo, stage, action, lines: options.lines, edge: options.edge, since: options.logSince, until: options.logUntil, task: options.task, artifact: options.artifact, confirmDataLoss: options.confirmDataLoss });
-  if (!d.ok) {
-    const transport = d.category === "transport-failed";
-    return {
-      ...base,
-      dispatched: false,
-      conclusion: "failure",
-      category: action === "retire" ? transport ? "transport-failed" : "dispatch-rejected" : void 0,
-      note: transport ? `runtime tenant control ${action} dispatch failed (transport) \u2014 safe to retry` : `runtime tenant control ${action} rejected: ${d.error ?? "request rejected by the Hub"}`
-    };
-  }
-  const correlated = await correlateControlRun(deps, since, [stage, action, ...action === "run-task" && options.task ? [options.task] : []]);
-  if (correlated.read === "failed") {
-    return {
-      ...base,
-      dispatched: true,
-      conclusion: "failure",
-      category: action === "retire" ? "wait-timeout" : void 0,
-      note: `runtime tenant control ${action} dispatched, but its run could not be READ: ${correlated.error} \u2014 the run's outcome is unverified, not absent; check the Actions tab or retry once the read succeeds (#4713)`
-    };
+  let runId;
+  let runUrl;
+  if (options.resume != null) {
+    if (action !== "run-task") throw new Error("runtime tenant control: --resume is valid only for run-task");
+    let view;
+    try {
+      view = JSON.parse(await deps.run("gh", ["run", "view", String(options.resume), "--repo", HUB_REPO2, "--json", "workflowName,displayTitle,url"]));
+    } catch (e) {
+      throw new Error(`runtime tenant control: run ${options.resume} could not be READ: ${e.message}`);
+    }
+    const f = (view.displayTitle ?? "").split(" ");
+    if (view.workflowName !== "tenant-control" || f[0] !== "tenant-control" || f[1] !== (repo.split("/")[1] ?? "").toLowerCase() || f[2] !== stage || f[3] !== "run-task") {
+      throw new Error(`runtime tenant control: run ${options.resume} is not a tenant-control run-task run for ${repo} ${stage} (title: ${view.displayTitle ?? "unreadable"}) \u2014 refusing to resume it`);
+    }
+    runId = options.resume;
+    runUrl = view.url;
+  } else {
+    const d = await deps.dispatchTenantControl({ repo, stage, action, lines: options.lines, edge: options.edge, since: options.logSince, until: options.logUntil, task: options.task, artifact: options.artifact, confirmDataLoss: options.confirmDataLoss });
+    if (!d.ok) {
+      const transport = d.category === "transport-failed";
+      return {
+        ...base,
+        dispatched: false,
+        conclusion: "failure",
+        category: action === "retire" ? transport ? "transport-failed" : "dispatch-rejected" : void 0,
+        note: transport ? `runtime tenant control ${action} dispatch failed (transport) \u2014 safe to retry` : `runtime tenant control ${action} rejected: ${d.error ?? "request rejected by the Hub"}`
+      };
+    }
+    const correlated = await correlateControlRun(deps, since, [stage, action, ...action === "run-task" && options.task ? [options.task] : []]);
+    if (correlated.read === "failed") {
+      return {
+        ...base,
+        dispatched: true,
+        conclusion: "failure",
+        category: action === "retire" ? "wait-timeout" : void 0,
+        note: `runtime tenant control ${action} dispatched, but its run could not be READ: ${correlated.error} \u2014 the run's outcome is unverified, not absent; check the Actions tab or retry once the read succeeds (#4713)`
+      };
+    }
+    ({ runId, runUrl } = correlated);
   }
-  const { runId, runUrl } = correlated;
   const conclusion = watch ? await watchTenantRun(deps, runId) : "pending";
   const result = { ...base, dispatched: true, runId, runUrl, conclusion, note: "" };
   if (action === "retire") {
@@ -22213,6 +22385,9 @@ async function runTenantControl(deps, options) {
     }
   }
   result.note = conclusion === "success" ? `tenant-control ${action} run succeeded` : conclusion === "failure" ? `tenant-control ${action} run failed \u2014 inspect the run` : runId == null ? `dispatched tenant-control.yml (${action}) \u2014 run not correlated; check the Actions tab` : `dispatched tenant-control.yml (${action}) \u2014 not watched`;
+  if (conclusion === "pending" && runId != null && action === "run-task") {
+    result.note += `; run ${runId} \u2014 resume without re-dispatching: mmi-cli devops runtime tenant control ${repo} ${stage} run-task --resume ${runId} --watch`;
+  }
   return result;
 }
 function renderTenantControl(r) {
@@ -22232,9 +22407,9 @@ function renderTenantControl(r) {
 }
 
 // src/train-apply-phases.ts
-var import_node_fs25 = require("node:fs");
+var import_node_fs26 = require("node:fs");
 var import_promises4 = require("node:fs/promises");
-var import_node_path24 = require("node:path");
+var import_node_path25 = require("node:path");
 
 // src/actions-billing-preflight.ts
 var CANARY_WORKFLOW = "actions-job-start-canary.yml";
@@ -22542,14 +22717,14 @@ function assertPreOneZero(repo, meta, tag) {
 
 // src/train-doctor.ts
 var import_node_child_process9 = require("node:child_process");
-var import_node_fs23 = require("node:fs");
-var import_node_os14 = require("node:os");
-var import_node_path23 = require("node:path");
+var import_node_fs24 = require("node:fs");
+var import_node_os15 = require("node:os");
+var import_node_path24 = require("node:path");
 
 // src/doctor-io.ts
-var import_node_fs20 = require("node:fs");
-var import_node_os11 = require("node:os");
-var import_node_path18 = require("node:path");
+var import_node_fs21 = require("node:fs");
+var import_node_os12 = require("node:os");
+var import_node_path19 = require("node:path");
 var import_node_child_process7 = require("node:child_process");
 var import_node_util4 = require("node:util");
 
@@ -22562,8 +22737,8 @@ function nodeDiscardSinkPath(platform2 = process.platform) {
 var execFileP2 = (0, import_node_util4.promisify)(import_node_child_process7.execFile);
 function execFileCapture(file, args, opts = {}) {
   const sink = nodeDiscardSinkPath();
-  const inFd = (0, import_node_fs20.openSync)(sink, "r");
-  const errFd = (0, import_node_fs20.openSync)(sink, "w");
+  const inFd = (0, import_node_fs21.openSync)(sink, "r");
+  const errFd = (0, import_node_fs21.openSync)(sink, "w");
   try {
     return (0, import_node_child_process7.execFileSync)(file, args, {
       ...opts,
@@ -22571,17 +22746,17 @@ function execFileCapture(file, args, opts = {}) {
       stdio: [inFd, "pipe", errFd]
     });
   } finally {
-    (0, import_node_fs20.closeSync)(inFd);
-    (0, import_node_fs20.closeSync)(errFd);
+    (0, import_node_fs21.closeSync)(inFd);
+    (0, import_node_fs21.closeSync)(errFd);
   }
 }
 var MMI_PLUGIN_ID2 = "mmi@mutmutco";
 function stagedClaudePluginVersion() {
   try {
-    const stagingRoot = (0, import_node_path18.join)((0, import_node_os11.homedir)(), ".claude", "plugins", "staging");
-    const record = JSON.parse((0, import_node_fs20.readFileSync)((0, import_node_path18.join)(stagingRoot, "launch-target.json"), "utf8"));
+    const stagingRoot = (0, import_node_path19.join)((0, import_node_os12.homedir)(), ".claude", "plugins", "staging");
+    const record = JSON.parse((0, import_node_fs21.readFileSync)((0, import_node_path19.join)(stagingRoot, "launch-target.json"), "utf8"));
     if (typeof record.target !== "string" || typeof record.incoming !== "string") return void 0;
-    const manifest = JSON.parse((0, import_node_fs20.readFileSync)((0, import_node_path18.join)(record.incoming, ".claude-plugin", "plugin.json"), "utf8"));
+    const manifest = JSON.parse((0, import_node_fs21.readFileSync)((0, import_node_path19.join)(record.incoming, ".claude-plugin", "plugin.json"), "utf8"));
     if (typeof manifest.version !== "string") return void 0;
     return manifest.version === record.target ? record.target : void 0;
   } catch {
@@ -22591,7 +22766,7 @@ function stagedClaudePluginVersion() {
 function installedClaudePluginVersion() {
   try {
     const file = JSON.parse(
-      (0, import_node_fs20.readFileSync)((0, import_node_path18.join)((0, import_node_os11.homedir)(), ".claude", "plugins", "installed_plugins.json"), "utf8")
+      (0, import_node_fs21.readFileSync)((0, import_node_path19.join)((0, import_node_os12.homedir)(), ".claude", "plugins", "installed_plugins.json"), "utf8")
     );
     const versions = (file.plugins?.[MMI_PLUGIN_ID2] ?? []).map((r) => r.version).filter((v) => Boolean(v));
     if (versions.length === 0) return void 0;
@@ -22603,12 +22778,12 @@ function installedClaudePluginVersion() {
 function readHermesPluginEvidence(env = process.env) {
   const host = hermesConfigRoot(env);
   const root = hermesPluginRoot(env);
-  const installRecordPresent = (0, import_node_fs20.existsSync)(root);
-  const manifestPath = (0, import_node_path18.join)(root, "plugin.yaml");
+  const installRecordPresent = (0, import_node_fs21.existsSync)(root);
+  const manifestPath = (0, import_node_path19.join)(root, "plugin.yaml");
   let installedVersion;
   let manifest = "missing";
   try {
-    const text = (0, import_node_fs20.readFileSync)(manifestPath, "utf8");
+    const text = (0, import_node_fs21.readFileSync)(manifestPath, "utf8");
     let version;
     try {
       const parsed = JSON.parse(text).version;
@@ -22622,25 +22797,25 @@ function readHermesPluginEvidence(env = process.env) {
     if (version) {
       installedVersion = version;
       manifest = "valid";
-    } else if ((0, import_node_fs20.existsSync)(manifestPath)) manifest = "invalid";
+    } else if ((0, import_node_fs21.existsSync)(manifestPath)) manifest = "invalid";
   } catch {
-    if ((0, import_node_fs20.existsSync)(manifestPath)) manifest = "invalid";
+    if ((0, import_node_fs21.existsSync)(manifestPath)) manifest = "invalid";
   }
   let skills = false;
   try {
-    skills = (0, import_node_fs20.existsSync)((0, import_node_path18.join)(root, "skills")) && (0, import_node_fs20.statSync)((0, import_node_path18.join)(root, "skills")).isDirectory();
+    skills = (0, import_node_fs21.existsSync)((0, import_node_path19.join)(root, "skills")) && (0, import_node_fs21.statSync)((0, import_node_path19.join)(root, "skills")).isDirectory();
   } catch {
   }
   let provisioned = false;
-  const provisionedRoot = (0, import_node_path18.join)(host, "skills", "mmi");
+  const provisionedRoot = (0, import_node_path19.join)(host, "skills", "mmi");
   try {
-    provisioned = (0, import_node_fs20.existsSync)(provisionedRoot) && (0, import_node_fs20.statSync)(provisionedRoot).isDirectory();
+    provisioned = (0, import_node_fs21.existsSync)(provisionedRoot) && (0, import_node_fs21.statSync)(provisionedRoot).isDirectory();
   } catch {
   }
-  const treeOk = (0, import_node_fs20.existsSync)((0, import_node_path18.join)(root, "__init__.py")) && skills && manifest === "valid";
+  const treeOk = (0, import_node_fs21.existsSync)((0, import_node_path19.join)(root, "__init__.py")) && skills && manifest === "valid";
   const receipt = treeOk && !provisioned ? `hermes-skills-unprovisioned:${provisionedRoot}` : void 0;
   return {
-    hostPresent: (0, import_node_fs20.existsSync)(host),
+    hostPresent: (0, import_node_fs21.existsSync)(host),
     installRecordPresent,
     manifest,
     payloadPresent: treeOk && provisioned,
@@ -22686,13 +22861,13 @@ function worktreeRootSync() {
 }
 var gitignorePath = () => {
   const root = worktreeRootSync();
-  return root === null ? null : (0, import_node_path18.join)(root, ".gitignore");
+  return root === null ? null : (0, import_node_path19.join)(root, ".gitignore");
 };
 function readGitignore() {
   const path2 = gitignorePath();
   if (path2 === null) return null;
   try {
-    return (0, import_node_fs20.readFileSync)(path2, "utf8");
+    return (0, import_node_fs21.readFileSync)(path2, "utf8");
   } catch {
     return null;
   }
@@ -22701,14 +22876,14 @@ function writeGitignore(content) {
   const path2 = gitignorePath();
   if (path2 === null) return false;
   try {
-    (0, import_node_fs20.writeFileSync)(path2, content, "utf8");
+    (0, import_node_fs21.writeFileSync)(path2, content, "utf8");
     return true;
   } catch {
     return false;
   }
 }
 function lineEndingState(root) {
-  const attributesPresent = (0, import_node_fs20.existsSync)((0, import_node_path18.join)(root, ".gitattributes"));
+  const attributesPresent = (0, import_node_fs21.existsSync)((0, import_node_path19.join)(root, ".gitattributes"));
   try {
     const output = execFileCapture("git", ["-C", root, "ls-files", "--eol", "--", ":(glob)**/*.sh"], {
       windowsHide: true
@@ -22751,18 +22926,18 @@ function compatHolds(range, version) {
 }
 
 // src/claude-binary-doctor.ts
-var import_node_fs21 = require("node:fs");
-var import_node_os13 = require("node:os");
-var import_node_path20 = require("node:path");
+var import_node_fs22 = require("node:fs");
+var import_node_os14 = require("node:os");
+var import_node_path21 = require("node:path");
 
 // src/jerv-cli-spawn.ts
-var import_node_os12 = require("node:os");
-var import_node_path19 = require("node:path");
+var import_node_os13 = require("node:os");
+var import_node_path20 = require("node:path");
 init_cli_shared();
-var JERV_CLI_ENTRY = (0, import_node_path19.join)("node_modules", "@jervaise", "jerv-cli", "dist", "index.cjs");
+var JERV_CLI_ENTRY = (0, import_node_path20.join)("node_modules", "@jervaise", "jerv-cli", "dist", "index.cjs");
 function pathEnvEntries(pathEnv, platform2 = process.platform) {
   if (platform2 !== "win32") {
-    return pathEnv.split(import_node_path19.delimiter).map((e) => e.trim()).filter(Boolean);
+    return pathEnv.split(import_node_path20.delimiter).map((e) => e.trim()).filter(Boolean);
   }
   if (pathEnv.includes(";")) {
     return pathEnv.split(";").map((e) => e.trim()).filter(Boolean);
@@ -22781,7 +22956,7 @@ function normalizeSpawnPathEntry(entry, platform2 = process.platform) {
   if (msys) return `${msys[1].toUpperCase()}:\\${msys[2].replace(/\//g, "\\")}`;
   return trimmed;
 }
-function jervCliCandidateDirs(env = process.env, home = (0, import_node_os12.homedir)(), platform2 = process.platform) {
+function jervCliCandidateDirs(env = process.env, home = (0, import_node_os13.homedir)(), platform2 = process.platform) {
   const seen = /* @__PURE__ */ new Set();
   const out = [];
   const push = (dir) => {
@@ -22795,10 +22970,10 @@ function jervCliCandidateDirs(env = process.env, home = (0, import_node_os12.hom
     push(normalizeSpawnPathEntry(entry, platform2));
   }
   if (platform2 === "win32") {
-    if (env.APPDATA) push((0, import_node_path19.join)(env.APPDATA, "npm"));
-    if (env.LOCALAPPDATA) push((0, import_node_path19.join)(env.LOCALAPPDATA, "npm"));
+    if (env.APPDATA) push((0, import_node_path20.join)(env.APPDATA, "npm"));
+    if (env.LOCALAPPDATA) push((0, import_node_path20.join)(env.LOCALAPPDATA, "npm"));
   } else {
-    push((0, import_node_path19.join)(home, ".local", "bin"));
+    push((0, import_node_path20.join)(home, ".local", "bin"));
   }
   return out;
 }
@@ -22851,26 +23026,26 @@ function globalNodeModulesRoots(host) {
     out.push(dir);
   };
   const prefix = env.npm_config_prefix?.trim();
-  if (prefix) push(platform2 === "win32" ? (0, import_node_path20.join)(prefix, "node_modules") : (0, import_node_path20.join)(prefix, "lib", "node_modules"));
-  for (const dir of jervCliCandidateDirs(env, host.home ?? (0, import_node_os13.homedir)(), platform2)) {
-    push((0, import_node_path20.join)(dir, "node_modules"));
-    push((0, import_node_path20.join)((0, import_node_path20.dirname)(dir), "lib", "node_modules"));
+  if (prefix) push(platform2 === "win32" ? (0, import_node_path21.join)(prefix, "node_modules") : (0, import_node_path21.join)(prefix, "lib", "node_modules"));
+  for (const dir of jervCliCandidateDirs(env, host.home ?? (0, import_node_os14.homedir)(), platform2)) {
+    push((0, import_node_path21.join)(dir, "node_modules"));
+    push((0, import_node_path21.join)((0, import_node_path21.dirname)(dir), "lib", "node_modules"));
   }
   return out;
 }
 function readHead(path2) {
   let fd;
   try {
-    fd = (0, import_node_fs21.openSync)(path2, "r");
+    fd = (0, import_node_fs22.openSync)(path2, "r");
     const buffer = new Uint8Array(MAGIC_HEAD_BYTES);
-    const read = (0, import_node_fs21.readSync)(fd, buffer, 0, MAGIC_HEAD_BYTES, 0);
+    const read = (0, import_node_fs22.readSync)(fd, buffer, 0, MAGIC_HEAD_BYTES, 0);
     return buffer.subarray(0, read);
   } catch {
     return void 0;
   } finally {
     if (fd !== void 0) {
       try {
-        (0, import_node_fs21.closeSync)(fd);
+        (0, import_node_fs22.closeSync)(fd);
       } catch {
       }
     }
@@ -22878,7 +23053,7 @@ function readHead(path2) {
 }
 function fileBytes(path2) {
   try {
-    return (0, import_node_fs21.statSync)(path2).size;
+    return (0, import_node_fs22.statSync)(path2).size;
   } catch {
     return void 0;
   }
@@ -22892,17 +23067,17 @@ function readClaudeBinaryState(host = {}) {
   const arch = host.arch ?? process.arch;
   const magic = EXECUTABLE_MAGIC[platform2];
   if (!magic) return void 0;
-  const packageRoot = globalNodeModulesRoots(host).map((root) => (0, import_node_path20.join)(root, ...PACKAGE.split("/"))).find((dir) => (0, import_node_fs21.existsSync)((0, import_node_path20.join)(dir, "package.json")));
+  const packageRoot = globalNodeModulesRoots(host).map((root) => (0, import_node_path21.join)(root, ...PACKAGE.split("/"))).find((dir) => (0, import_node_fs22.existsSync)((0, import_node_path21.join)(dir, "package.json")));
   if (!packageRoot) return void 0;
   const keys = platformPackageKeys(platform2, arch);
   const fallbackPackage = `${PACKAGE}-${keys[0]}`;
   let manifest;
   try {
-    manifest = JSON.parse((0, import_node_fs21.readFileSync)((0, import_node_path20.join)(packageRoot, "package.json"), "utf8"));
+    manifest = JSON.parse((0, import_node_fs22.readFileSync)((0, import_node_path21.join)(packageRoot, "package.json"), "utf8"));
   } catch (e) {
     return {
       state: "unreadable",
-      binPath: (0, import_node_path20.join)(packageRoot, "package.json"),
+      binPath: (0, import_node_path21.join)(packageRoot, "package.json"),
       expectedMagic: magic.name,
       platformPackage: fallbackPackage,
       error: `package.json could not be read \u2014 ${e.message}`
@@ -22919,17 +23094,17 @@ function readClaudeBinaryState(host = {}) {
       error: "package.json declares no `bin` entry \u2014 the executed file cannot be resolved"
     };
   }
-  const binPath = (0, import_node_path20.join)(packageRoot, binRelative);
-  const binName = (0, import_node_path20.basename)(binRelative);
+  const binPath = (0, import_node_path21.join)(packageRoot, binRelative);
+  const binName = (0, import_node_path21.basename)(binRelative);
   const optional = manifest.optionalDependencies;
   const publishes = (name) => typeof optional === "object" && optional !== null && Object.prototype.hasOwnProperty.call(optional, name);
   const published = keys.map((key) => `${PACKAGE}-${key}`).filter(publishes);
   if (published.length === 0) return void 0;
   const binIn = (name) => [
-    (0, import_node_path20.join)(packageRoot, "node_modules", ...name.split("/"), binName),
-    (0, import_node_path20.join)((0, import_node_path20.dirname)((0, import_node_path20.dirname)(packageRoot)), ...name.split("/"), binName)
+    (0, import_node_path21.join)(packageRoot, "node_modules", ...name.split("/"), binName),
+    (0, import_node_path21.join)((0, import_node_path21.dirname)((0, import_node_path21.dirname)(packageRoot)), ...name.split("/"), binName)
   ];
-  const found = published.map((name) => ({ name, path: binIn(name).find((file) => (0, import_node_fs21.existsSync)(file)) })).find((c) => c.path);
+  const found = published.map((name) => ({ name, path: binIn(name).find((file) => (0, import_node_fs22.existsSync)(file)) })).find((c) => c.path);
   const platformPackage = found?.name ?? published[0];
   let source;
   let sourceProblem;
@@ -22940,7 +23115,7 @@ function readClaudeBinaryState(host = {}) {
   } else {
     source = { path: found.path, bytes: fileBytes(found.path) ?? 0 };
   }
-  if (!(0, import_node_fs21.existsSync)(binPath)) {
+  if (!(0, import_node_fs22.existsSync)(binPath)) {
     return { state: "missing", binPath, expectedMagic: magic.name, platformPackage, ...source ? { source } : {}, ...sourceProblem ? { sourceProblem } : {} };
   }
   const head = readHead(binPath);
@@ -22983,9 +23158,9 @@ function healClaudeBinary(host = {}, onStep) {
   const platform2 = host.platform ?? process.platform;
   const aside = `${probe.binPath}.stub-${Date.now()}`;
   let renamed = false;
-  if ((0, import_node_fs21.existsSync)(probe.binPath)) {
+  if ((0, import_node_fs22.existsSync)(probe.binPath)) {
     try {
-      (0, import_node_fs21.renameSync)(probe.binPath, aside);
+      (0, import_node_fs22.renameSync)(probe.binPath, aside);
       renamed = true;
       onStep?.(`renamed the stub aside: ${aside}`);
     } catch (e) {
@@ -22994,12 +23169,12 @@ function healClaudeBinary(host = {}, onStep) {
   }
   try {
     onStep?.(`copying ${probe.source.path} \u2192 ${probe.binPath} (${(probe.source.bytes / 1e6).toFixed(0)} MB)`);
-    (0, import_node_fs21.copyFileSync)(probe.source.path, probe.binPath);
-    if (platform2 !== "win32") (0, import_node_fs21.chmodSync)(probe.binPath, 493);
+    (0, import_node_fs22.copyFileSync)(probe.source.path, probe.binPath);
+    if (platform2 !== "win32") (0, import_node_fs22.chmodSync)(probe.binPath, 493);
   } catch (e) {
     if (renamed) {
       try {
-        (0, import_node_fs21.renameSync)(aside, probe.binPath);
+        (0, import_node_fs22.renameSync)(aside, probe.binPath);
       } catch {
         return { ok: false, detail: `copy failed (${e.message}) and the stub could not be restored \u2014 the original is at ${aside}` };
       }
@@ -23013,7 +23188,7 @@ function healClaudeBinary(host = {}, onStep) {
   let kept = false;
   if (renamed) {
     try {
-      (0, import_node_fs21.rmSync)(aside);
+      (0, import_node_fs22.rmSync)(aside);
     } catch {
       kept = true;
     }
@@ -23372,13 +23547,13 @@ function checkLineEndings(probe) {
 }
 
 // src/release-ledger.ts
-var import_node_fs22 = require("node:fs");
-var import_node_path22 = require("node:path");
-var import_node_crypto8 = require("node:crypto");
+var import_node_fs23 = require("node:fs");
+var import_node_path23 = require("node:path");
+var import_node_crypto9 = require("node:crypto");
 
 // src/file-lock.ts
 var import_promises2 = require("node:fs/promises");
-var import_node_path21 = require("node:path");
+var import_node_path22 = require("node:path");
 function pidIsDead(pid) {
   if (!Number.isInteger(pid) || pid <= 0) return false;
   if (pid === process.pid) return false;
@@ -23496,7 +23671,7 @@ async function withFileLock(lockPath, opts, fn) {
 }
 async function withFencedFileLock(lockPath, opts, fn) {
   const resolved = resolveFileLockOpts(opts);
-  await (0, import_promises2.mkdir)((0, import_node_path21.dirname)(lockPath), { recursive: true }).catch(() => void 0);
+  await (0, import_promises2.mkdir)((0, import_node_path22.dirname)(lockPath), { recursive: true }).catch(() => void 0);
   const guard = await acquireFileLock(lockPath, resolved, Date.now() + resolved.maxWaitMs);
   try {
     return await fn(() => fileLockHeldBy(lockPath, guard.token));
@@ -23547,8 +23722,8 @@ function attachOutputNote(note, suffix) {
 }
 function writeFailingLegOutput(artifactPath, output) {
   const fileLines = lastNonEmptyLines(output, LEDGER_OUTPUT_FILE_LINES);
-  (0, import_node_fs22.mkdirSync)((0, import_node_path22.dirname)(artifactPath), { recursive: true });
-  (0, import_node_fs22.writeFileSync)(artifactPath, `${fileLines.join("\n")}
+  (0, import_node_fs23.mkdirSync)((0, import_node_path23.dirname)(artifactPath), { recursive: true });
+  (0, import_node_fs23.writeFileSync)(artifactPath, `${fileLines.join("\n")}
 `, "utf8");
   const tail = fileLines.slice(-LEDGER_OUTPUT_NOTE_LINES).join("\n");
   const noteSuffix = truncate(`failing-leg output: ${artifactPath}
@@ -23563,7 +23738,7 @@ function stampPhaseRecord(ledgerPath, tag, phase, entry, previousRetries, now) {
     if (raw) {
       try {
         const persisted = writeFailingLegOutput(
-          (0, import_node_path22.join)((0, import_node_path22.dirname)((0, import_node_path22.dirname)(ledgerPath)), "ledger-output", `${tag}-${phase}.txt`),
+          (0, import_node_path23.join)((0, import_node_path23.dirname)((0, import_node_path23.dirname)(ledgerPath)), "ledger-output", `${tag}-${phase}.txt`),
           raw
         );
         note = attachOutputNote(note, persisted.noteSuffix);
@@ -23716,30 +23891,30 @@ function resolvePrimaryGitDir(cwd) {
   }
   let common;
   try {
-    common = (0, import_node_fs22.readFileSync)((0, import_node_path22.join)(gitDir, "commondir"), "utf8").trim();
+    common = (0, import_node_fs23.readFileSync)((0, import_node_path23.join)(gitDir, "commondir"), "utf8").trim();
   } catch (e) {
     if (e.code !== "ENOENT") {
       throw new ReleaseLedgerError("unreadable", `release ledger: the worktree gitdir's commondir pointer could not be READ (${e instanceof Error ? e.message : String(e)}) \u2014 a failed read is unverified, not primary (#5987/#4713)`);
     }
   }
   if (!common) return gitDir;
-  const commonDir = (0, import_node_path22.isAbsolute)(common) ? common : (0, import_node_path22.resolve)(gitDir, common);
+  const commonDir = (0, import_node_path23.isAbsolute)(common) ? common : (0, import_node_path23.resolve)(gitDir, common);
   try {
-    (0, import_node_fs22.readFileSync)((0, import_node_path22.join)(commonDir, "HEAD"), "utf8");
+    (0, import_node_fs23.readFileSync)((0, import_node_path23.join)(commonDir, "HEAD"), "utf8");
   } catch (e) {
     throw new ReleaseLedgerError("no-checkout", `release ledger: the worktree's commondir pointer names ${commonDir}, which has no readable HEAD (${e instanceof Error ? e.message : String(e)}) \u2014 the primary checkout may have been removed; refusing to write the ledger into a doomed location`);
   }
   return commonDir;
 }
 function releaseLedgerPath(cwd) {
-  return (0, import_node_path22.join)(resolvePrimaryGitDir(cwd), "mmi-runtime", "release", "phases.json");
+  return (0, import_node_path23.join)(resolvePrimaryGitDir(cwd), "mmi-runtime", "release", "phases.json");
 }
 function atomicWriteJson(path2, ledger) {
-  (0, import_node_fs22.mkdirSync)((0, import_node_path22.dirname)(path2), { recursive: true });
-  const tmp = `${path2}.tmp-${process.pid}-${(0, import_node_crypto8.randomBytes)(4).toString("hex")}`;
-  (0, import_node_fs22.writeFileSync)(tmp, `${JSON.stringify(ledger, null, 2)}
+  (0, import_node_fs23.mkdirSync)((0, import_node_path23.dirname)(path2), { recursive: true });
+  const tmp = `${path2}.tmp-${process.pid}-${(0, import_node_crypto9.randomBytes)(4).toString("hex")}`;
+  (0, import_node_fs23.writeFileSync)(tmp, `${JSON.stringify(ledger, null, 2)}
 `, "utf8");
-  (0, import_node_fs22.renameSync)(tmp, path2);
+  (0, import_node_fs23.renameSync)(tmp, path2);
 }
 var LEDGER_LOCK_OPTS = { label: "release ledger", staleMs: 18e4, deadHolderSteal: true };
 async function withLedgerLock(path2, fn, opts = {}) {
@@ -23751,16 +23926,16 @@ async function withLedgerLock(path2, fn, opts = {}) {
   }));
 }
 function checkoutRootFrom(cwd) {
-  let dir = (0, import_node_path22.resolve)(cwd);
+  let dir = (0, import_node_path23.resolve)(cwd);
   for (; ; ) {
     if (resolveGitDir(dir)) return dir;
-    const parent = (0, import_node_path22.dirname)(dir);
+    const parent = (0, import_node_path23.dirname)(dir);
     if (parent === dir) throw new ReleaseLedgerError("no-checkout", `train writer lock: no git checkout found above ${cwd}`);
     dir = parent;
   }
 }
 function trainWriterLockPath(cwd) {
-  return (0, import_node_path22.join)((0, import_node_path22.dirname)(releaseLedgerPath(checkoutRootFrom(cwd))), "train.lock");
+  return (0, import_node_path23.join)((0, import_node_path23.dirname)(releaseLedgerPath(checkoutRootFrom(cwd))), "train.lock");
 }
 var TrainWriterBusyError = class extends Error {
   lockPath;
@@ -23786,7 +23961,7 @@ function describeTrainWriterToken(token) {
 function liveTrainWriterHolder(cwd) {
   let token;
   try {
-    token = (0, import_node_fs22.readFileSync)(trainWriterLockPath(cwd), "utf8");
+    token = (0, import_node_fs23.readFileSync)(trainWriterLockPath(cwd), "utf8");
   } catch {
     return void 0;
   }
@@ -23808,7 +23983,7 @@ async function acquireTrainWriterLock(cwd, verb) {
       if (heldTrainWriter) heldTrainWriter.depth -= 1;
     };
   }
-  (0, import_node_fs22.mkdirSync)((0, import_node_path22.dirname)(lockPath), { recursive: true });
+  (0, import_node_fs23.mkdirSync)((0, import_node_path23.dirname)(lockPath), { recursive: true });
   const opts = resolveFileLockOpts({ label: "train writer", staleMs: TRAIN_WRITER_STALE_MS, deadHolderSteal: true, maxWaitMs: 0, holder: verb });
   let guard;
   try {
@@ -23817,7 +23992,7 @@ async function acquireTrainWriterLock(cwd, verb) {
     if (!(e instanceof FileLockBusyError)) throw e;
     let token = "";
     try {
-      token = (0, import_node_fs22.readFileSync)(lockPath, "utf8");
+      token = (0, import_node_fs23.readFileSync)(lockPath, "utf8");
     } catch {
       token = "";
     }
@@ -23852,7 +24027,7 @@ async function withReleaseLedger(path2, expected, fn, opts = {}) {
     let current;
     let raw;
     try {
-      raw = (0, import_node_fs22.readFileSync)(path2, "utf8");
+      raw = (0, import_node_fs23.readFileSync)(path2, "utf8");
     } catch (e) {
       if (e.code !== "ENOENT") {
         throw new ReleaseLedgerError("unreadable", `release ledger at ${path2} could not be READ (${e instanceof Error ? e.message : String(e)}) \u2014 a failed read is unverified, not absent (#5987)`);
@@ -24521,7 +24696,7 @@ async function clearLedgerFile(path2, anchors, maxWaitMs) {
   return withLedgerLock(path2, async (fence) => {
     let raw;
     try {
-      raw = (0, import_node_fs22.readFileSync)(path2, "utf8");
+      raw = (0, import_node_fs23.readFileSync)(path2, "utf8");
     } catch (e) {
       if (e.code === "ENOENT") return { cleared: false };
       return { cleared: false, note: `release ledger at ${path2} could not be read for clearing (${e instanceof Error ? e.message : String(e)}) \u2014 left in place` };
@@ -24537,7 +24712,7 @@ async function clearLedgerFile(path2, anchors, maxWaitMs) {
     } catch (e) {
       return { cleared: false, note: `release ledger at ${path2} belongs to ${ledger.tag} @ ${ledger.tagSha.slice(0, 12)} \u2014 not this release; left in place (${e instanceof Error ? e.message : String(e)})` };
     }
-    await fence(() => (0, import_node_fs22.unlinkSync)(path2));
+    await fence(() => (0, import_node_fs23.unlinkSync)(path2));
     return { cleared: true, note: `cleared the release ledger at ${path2} for the live-proven aborted ${anchors.tag}` };
   }, { maxWaitMs });
 }
@@ -24697,7 +24872,7 @@ async function healStaleAlignmentLeg(deps, cwd, expected) {
   return withLedgerLock(path2, async (fence) => {
     let prior;
     try {
-      prior = parseReleaseLedger((0, import_node_fs22.readFileSync)(path2, "utf8"));
+      prior = parseReleaseLedger((0, import_node_fs23.readFileSync)(path2, "utf8"));
     } catch {
       return void 0;
     }
@@ -24722,7 +24897,7 @@ async function healUnfoldedRunLegs(deps, cwd, model) {
   const path2 = releaseLedgerPath(cwd);
   let prior;
   try {
-    prior = parseReleaseLedger((0, import_node_fs22.readFileSync)(path2, "utf8"));
+    prior = parseReleaseLedger((0, import_node_fs23.readFileSync)(path2, "utf8"));
   } catch {
     return void 0;
   }
@@ -24791,7 +24966,7 @@ async function supersedeContentCausedDeployLeg(deps, cwd) {
   return withLedgerLock(path2, async (fence) => {
     let prior;
     try {
-      prior = parseReleaseLedger((0, import_node_fs22.readFileSync)(path2, "utf8"));
+      prior = parseReleaseLedger((0, import_node_fs23.readFileSync)(path2, "utf8"));
     } catch (e) {
       throw new ReleaseLedgerError(
         "unreadable",
@@ -24888,11 +25063,11 @@ async function proveOriginPromotionOrArchived(deps, prior, path2, label, ref, fe
   if (!releaseAbsent) {
     throw new Error(`${label}: origin no longer has ${prior.tag} but its GitHub Release still exists \u2014 resolve the mixed external state before closing the ledger; nothing was written (${ref})`);
   }
-  const archivePath = (0, import_node_path22.join)((0, import_node_path22.dirname)(path2), `phases.archive-${prior.tag}.json`);
-  if ((0, import_node_fs22.existsSync)(archivePath)) {
+  const archivePath = (0, import_node_path23.join)((0, import_node_path23.dirname)(path2), `phases.archive-${prior.tag}.json`);
+  if ((0, import_node_fs23.existsSync)(archivePath)) {
     throw new Error(`${label}: archive already exists at ${archivePath} \u2014 preserving both ledger records; resolve the collision by hand; nothing was written (${ref})`);
   }
-  await fence(() => (0, import_node_fs22.renameSync)(path2, archivePath));
+  await fence(() => (0, import_node_fs23.renameSync)(path2, archivePath));
   return "deleted";
 }
 async function supersedeContentCausedPublishLeg(deps, cwd) {
@@ -24900,7 +25075,7 @@ async function supersedeContentCausedPublishLeg(deps, cwd) {
   return withLedgerLock(path2, async (fence) => {
     let prior;
     try {
-      prior = parseReleaseLedger((0, import_node_fs22.readFileSync)(path2, "utf8"));
+      prior = parseReleaseLedger((0, import_node_fs23.readFileSync)(path2, "utf8"));
     } catch (e) {
       throw new ReleaseLedgerError(
         "unreadable",
@@ -24982,7 +25157,7 @@ async function supersedeContentCausedDeployAndPublishLegs(deps, cwd) {
   return withLedgerLock(path2, async (fence) => {
     let prior;
     try {
-      prior = parseReleaseLedger((0, import_node_fs22.readFileSync)(path2, "utf8"));
+      prior = parseReleaseLedger((0, import_node_fs23.readFileSync)(path2, "utf8"));
     } catch (e) {
       throw new ReleaseLedgerError(
         "unreadable",
@@ -25087,7 +25262,7 @@ async function supersedeContentCausedDeployAndPublishLegs(deps, cwd) {
 async function reverifyPriorRunLegs(deps, path2, targetTag) {
   let prior;
   try {
-    prior = parseReleaseLedger((0, import_node_fs22.readFileSync)(path2, "utf8"));
+    prior = parseReleaseLedger((0, import_node_fs23.readFileSync)(path2, "utf8"));
   } catch {
     return;
   }
@@ -25107,7 +25282,7 @@ async function beginReleaseLedger(deps, cwd, targetTag) {
   return withLedgerLock(path2, async (fence) => {
     let raw;
     try {
-      raw = (0, import_node_fs22.readFileSync)(path2, "utf8");
+      raw = (0, import_node_fs23.readFileSync)(path2, "utf8");
     } catch (e) {
       if (e.code === "ENOENT") return { ok: true };
       return { ok: false, error: `the release ledger at ${path2} could not be READ (${e instanceof Error ? e.message : String(e)}) \u2014 a failed read is unverified, not absent (#5987/#4713)` };
@@ -25145,15 +25320,15 @@ async function beginReleaseLedger(deps, cwd, targetTag) {
     if (liveSha.toLowerCase() !== prior.tagSha.toLowerCase()) {
       return { ok: false, error: `the completed ${prior.tag} ledger says phases-green but origin reports ${liveSha.slice(0, 12) || "no tag"} \u2260 ${prior.tagSha.slice(0, 12)} \u2014 refusing to archive on unproven state; resolve by hand (#5987)` };
     }
-    const archivePath = (0, import_node_path22.join)((0, import_node_path22.dirname)(path2), `phases.archive-${prior.tag}.json`);
+    const archivePath = (0, import_node_path23.join)((0, import_node_path23.dirname)(path2), `phases.archive-${prior.tag}.json`);
     try {
-      await fence(() => (0, import_node_fs22.unlinkSync)(archivePath));
+      await fence(() => (0, import_node_fs23.unlinkSync)(archivePath));
     } catch (e) {
       if (e.code !== "ENOENT") {
         return { ok: false, error: `could not clear the stale archive at ${archivePath} (${e instanceof Error ? e.message : String(e)}) \u2014 the ledger for ${prior.tag} stays active (#5987)` };
       }
     }
-    await fence(() => (0, import_node_fs22.renameSync)(path2, archivePath));
+    await fence(() => (0, import_node_fs23.renameSync)(path2, archivePath));
     return { ok: true, note: `archived the completed release ledger ${prior.tag} to ${archivePath} (live-proven at ${prior.tagSha.slice(0, 12)})` };
   });
 }
@@ -25181,7 +25356,7 @@ async function retryHotfixDeployLegs(deps, cwd, opts = {}) {
   return withLedgerLock(path2, async (fence) => {
     let prior;
     try {
-      prior = parseReleaseLedger((0, import_node_fs22.readFileSync)(path2, "utf8"));
+      prior = parseReleaseLedger((0, import_node_fs23.readFileSync)(path2, "utf8"));
     } catch (e) {
       throw new ReleaseLedgerError(
         "unreadable",
@@ -25372,10 +25547,10 @@ function readOriginWorkflowsDefault(root, ref) {
 }
 var NPM_REGISTRY = "https://registry.npmjs.org";
 async function probeRegistryWhoami(train) {
-  const dir = (0, import_node_fs23.mkdtempSync)((0, import_node_path23.join)((0, import_node_os14.tmpdir)(), "mmi-npmrc-"));
-  const rc = (0, import_node_path23.join)(dir, "npmrc");
+  const dir = (0, import_node_fs24.mkdtempSync)((0, import_node_path24.join)((0, import_node_os15.tmpdir)(), "mmi-npmrc-"));
+  const rc = (0, import_node_path24.join)(dir, "npmrc");
   try {
-    (0, import_node_fs23.writeFileSync)(rc, "//registry.npmjs.org/:_authToken=${NPM_TOKEN}\n");
+    (0, import_node_fs24.writeFileSync)(rc, "//registry.npmjs.org/:_authToken=${NPM_TOKEN}\n");
     await train.runSelf(["secrets", "use", "npm/NPM_TOKEN", "--slug", "_org", "--", "npm", "whoami", "--registry", NPM_REGISTRY, "--userconfig", rc]);
     return { kind: "ok", detail: "the registry answered a login" };
   } catch (e) {
@@ -25386,7 +25561,7 @@ async function probeRegistryWhoami(train) {
     if (/\bE401\b|401 Unauthorized/.test(stderr)) return { kind: "rejected", detail: "npm whoami answered 401 Unauthorized" };
     return { kind: "unverified", detail: first };
   } finally {
-    (0, import_node_fs23.rmSync)(dir, { recursive: true, force: true });
+    (0, import_node_fs24.rmSync)(dir, { recursive: true, force: true });
   }
 }
 var REGISTRY_TOKEN_ENV = /\b(NODE_AUTH_TOKEN|NPM_TOKEN)\b/;
@@ -25404,7 +25579,7 @@ var defaultDeps2 = {
   ledgerPath: releaseLedgerPath,
   readLedgerRaw: (path2) => {
     try {
-      return (0, import_node_fs23.readFileSync)(path2, "utf8");
+      return (0, import_node_fs24.readFileSync)(path2, "utf8");
     } catch (e) {
       if (e.code === "ENOENT") return void 0;
       throw e;
@@ -25415,7 +25590,7 @@ var defaultDeps2 = {
   trainWriterHolder: liveTrainWriterHolder,
   readSurfacesRaw: (cwd) => {
     try {
-      return (0, import_node_fs23.readFileSync)((0, import_node_path23.join)(cwd, "surfaces.json"), "utf8");
+      return (0, import_node_fs24.readFileSync)((0, import_node_path24.join)(cwd, "surfaces.json"), "utf8");
     } catch {
       return void 0;
     }
@@ -26005,7 +26180,7 @@ function formatTrainDoctor(v) {
 
 // src/release-plain-words.ts
 var import_promises3 = require("node:fs/promises");
-var import_node_fs24 = require("node:fs");
+var import_node_fs25 = require("node:fs");
 function releaseCutByNotes(cutBy) {
   return `## Internal
 Cut by ${formatSessionIdentity(cutBy)}
@@ -26030,7 +26205,7 @@ function validateSuiteReleaseSummary(path2) {
   if (!path2) throw new Error(`requires --announce-summary-file <path> before promoting any member \u2014 see ${SUMMARY_GUIDE}`);
   let content;
   try {
-    content = (0, import_node_fs24.readFileSync)(path2, "utf8");
+    content = (0, import_node_fs25.readFileSync)(path2, "utf8");
   } catch (e) {
     throw new Error(`could not read summary file ${path2}: ${e.message} \u2014 see ${SUMMARY_GUIDE}`);
   }
@@ -26237,34 +26412,34 @@ function vercelVersionEnvDeps(deps) {
 // src/train-apply-phases.ts
 var TRAIN_BUMP_INTENTS = ["major", "minor", "patch"];
 function readLocalGateWorkflows() {
-  const dir = (0, import_node_path24.join)(".github", "workflows");
+  const dir = (0, import_node_path25.join)(".github", "workflows");
   let names;
   try {
-    names = (0, import_node_fs25.readdirSync)(dir);
+    names = (0, import_node_fs26.readdirSync)(dir);
   } catch {
     return null;
   }
   const files = [];
   for (const name of names.filter(isGateWorkflowPath)) {
     try {
-      files.push({ path: `${dir}/${name}`.replace(/\\/g, "/"), body: (0, import_node_fs25.readFileSync)((0, import_node_path24.join)(dir, name), "utf8") });
+      files.push({ path: `${dir}/${name}`.replace(/\\/g, "/"), body: (0, import_node_fs26.readFileSync)((0, import_node_path25.join)(dir, name), "utf8") });
     } catch {
     }
   }
   return files;
 }
 function readLocalWorkflows() {
-  const dir = (0, import_node_path24.join)(".github", "workflows");
+  const dir = (0, import_node_path25.join)(".github", "workflows");
   let names;
   try {
-    names = (0, import_node_fs25.readdirSync)(dir);
+    names = (0, import_node_fs26.readdirSync)(dir);
   } catch {
     return null;
   }
   const files = [];
   for (const name of names.filter((n) => /\.ya?ml$/i.test(n))) {
     try {
-      files.push({ path: `${dir}/${name}`.replace(/\\/g, "/"), body: (0, import_node_fs25.readFileSync)((0, import_node_path24.join)(dir, name), "utf8") });
+      files.push({ path: `${dir}/${name}`.replace(/\\/g, "/"), body: (0, import_node_fs26.readFileSync)((0, import_node_path25.join)(dir, name), "utf8") });
     } catch {
     }
   }
@@ -27146,7 +27321,7 @@ async function activeRcandLedgerCandidate(deps, cwd) {
   }
   let prior;
   try {
-    prior = parseReleaseLedger((0, import_node_fs25.readFileSync)(path2, "utf8"));
+    prior = parseReleaseLedger((0, import_node_fs26.readFileSync)(path2, "utf8"));
   } catch {
     return void 0;
   }
@@ -30428,11 +30603,11 @@ function buildPluginCachePlan(home, running, deps, opts = {}) {
     return absent;
   }
   const versions = names.filter(isVersionDirName);
-  const prune = selectPrunablePluginVersions(versions, running, opts.installedVersion);
-  const pruneSet = new Set(prune);
+  const prune2 = selectPrunablePluginVersions(versions, running, opts.installedVersion);
+  const pruneSet = new Set(prune2);
   const keep = [...versions].sort((a, b) => compareVersions(b, a)).filter((v) => !pruneSet.has(v));
-  const bytes = opts.withBytes ? prune.reduce((sum, v) => sum + deps.dirBytes(`${cacheRoot}/${v}`), 0) : 0;
-  return { cacheRoot, present: true, keep, prune, bytes, running, ...stagingFields };
+  const bytes = opts.withBytes ? prune2.reduce((sum, v) => sum + deps.dirBytes(`${cacheRoot}/${v}`), 0) : 0;
+  return { cacheRoot, present: true, keep, prune: prune2, bytes, running, ...stagingFields };
 }
 function applyPluginCachePlan(plan, remove2, stagingGuard) {
   const removed = [];
@@ -30741,6 +30916,12 @@ function registerBoardCommands(program3) {
       if (!o.out) console.log(output);
       else console.log(`Wrote board read to ${o.out} (UTF-8, ${writeUtf8Receipt(o.out, output)} bytes)`);
     } catch (e) {
+      if (e instanceof BoardSnapshotFailure) {
+        if (o.json) console.log(JSON.stringify(e.receipt));
+        console.error(`mmi-cli board read failed: ${e.message}`);
+        process.exitCode = e.exitCode;
+        return;
+      }
       if (o.json && e && typeof e === "object" && "quota" in e && e.quota) console.log(JSON.stringify(e.quota));
       return failGraceful(`board read failed: ${withDiscoverMissDetail(e.message)}`);
     }
@@ -30781,7 +30962,7 @@ function registerBoardCommands(program3) {
     return `Claimed ${ref} for ${holder} - In Progress${reclaimed}`;
   }
   const board = program3.command("board").description("read, claim, show, and move Project v2 work items for the current repo");
-  board.command("read", { isDefault: true }).alias("list").description("read the board and print user-owned, claimable, and taken items").option("--json", "machine-readable output").option("--repo <owner/repo>", "current repo (defaults to git origin)").option("--direct", "bypass the Hub snapshot and read the live board through direct GitHub GraphQL").option("--snapshot-only", "fail instead of falling back to your personal GraphQL pool when the Hub snapshot is unavailable \u2014 for ambient readers such as sidebars (#7203)").option("--min-cursor <n>", "board-event cursor (from `oracle board events`) the Hub snapshot must postdate; a cached snapshot older than that event is rebuilt (#7240)").option("--bundle-details", "fetch body/comments only for user-owned and claimable issues").option("--bodies", "fetch body/comments for EVERY scoped row, including taken and unowned in-flight ones \u2014 for consumers that scope by Status rather than ownership (#4861); implies --bundle-details and costs one extra read per row").option("--allow-partial", "return partial board results when later page/detail reads fail").option("--out <path>", "write the output to this file as UTF-8 (no BOM) instead of stdout \u2014 the shell-free receipt path (#5802)").addHelpText("after", "\nread is always the authoritative live GitHub Project v2 board (#4926).\n--direct skips the Hub snapshot and uses the existing direct GitHub GraphQL read immediately.\n--allow-partial applies to the paginated path and detail reads.\n\nWhen using Windows PowerShell 5.1, avoid shell redirects: PowerShell 5.1's `> file.json` is Out-File,\nwhich writes UTF-16LE with a BOM, and Node reading it as 'utf8' then fails JSON.parse at position 1\n(#5802). Use --out instead \u2014 the CLI writes the file itself as UTF-8:\n  mmi-cli oracle board read --json --out .jerv/tmp/board.json\n").action((o) => runBoardRead(o));
+  board.command("read", { isDefault: true }).alias("list").description("read the board and print user-owned, claimable, and taken items").option("--json", "machine-readable output").option("--repo <owner/repo>", "current repo (defaults to git origin)").option("--direct", "bypass the Hub snapshot and read the live board through direct GitHub GraphQL").option("--snapshot-only", "never fall back to your personal GraphQL pool; failure exits: 20 hub-unreachable, 21 app-quota-exhausted, 22 refused. With --json, stdout is {ok:false,outcome,reason[,resetAt,pool]} (pool is rest or graphql when known); success is unchanged").option("--min-cursor <n>", "board-event cursor (from `oracle board events`) the Hub snapshot must postdate; a cached snapshot older than that event is rebuilt (#7240)").option("--bundle-details", "fetch body/comments only for user-owned and claimable issues").option("--bodies", "fetch body/comments for EVERY scoped row, including taken and unowned in-flight ones \u2014 for consumers that scope by Status rather than ownership (#4861); implies --bundle-details and costs one extra read per row").option("--allow-partial", "return partial board results when later page/detail reads fail").option("--out <path>", "write the output to this file as UTF-8 (no BOM) instead of stdout \u2014 the shell-free receipt path (#5802)").addHelpText("after", "\nread is always the authoritative live GitHub Project v2 board (#4926).\n--direct skips the Hub snapshot and uses the existing direct GitHub GraphQL read immediately.\n--allow-partial applies to the paginated path and detail reads.\n\nWhen using Windows PowerShell 5.1, avoid shell redirects: PowerShell 5.1's `> file.json` is Out-File,\nwhich writes UTF-16LE with a BOM, and Node reading it as 'utf8' then fails JSON.parse at position 1\n(#5802). Use --out instead \u2014 the CLI writes the file itself as UTF-8:\n  mmi-cli oracle board read --json --out .jerv/tmp/board.json\n").action((o) => runBoardRead(o));
   board.command("events").description("content-free board/CI change records after a cursor, from the Hub event feed (no GitHub call) \u2014 for real-time sidebars (#7235)").option("--since <cursor>", "cursor from the previous answer; omit on first read (answers the head cursor with resync:true)").option("--wait <seconds>", "hold up to this long (max 120), polling every 2s, and return on the first event or resync", "0").option("--repo <owner/repo>", "repo whose Hub config to use (defaults to git origin)").option("--json", "machine-readable output (already the default)").addHelpText("after", "\nPrints {cursor, events, resync, more[, hidden]}. Pass the returned cursor as the next --since.\nresync:true means records were missed (retention ~1h, or a gap): re-read the board with\n`mmi-cli oracle board read --snapshot-only --json`.\n").action(async (o) => {
     try {
       if (o.since !== void 0 && !/^\d{1,15}$/.test(o.since)) throw new Error("--since must be a non-negative integer cursor");
@@ -31022,9 +31203,9 @@ function registerBoardCommands(program3) {
 }
 
 // src/bootstrap-commands.ts
-var import_node_fs29 = require("node:fs");
-var import_node_os17 = require("node:os");
-var import_node_path28 = require("node:path");
+var import_node_fs30 = require("node:fs");
+var import_node_os18 = require("node:os");
+var import_node_path29 = require("node:path");
 init_cli_shared();
 init_clean_exit();
 
@@ -31208,8 +31389,8 @@ init_github_client();
 init_cli_shared();
 
 // src/port-registry.ts
-var import_node_fs26 = require("node:fs");
-var import_node_path25 = require("node:path");
+var import_node_fs27 = require("node:fs");
+var import_node_path26 = require("node:path");
 
 // ../infra/port-geometry.mjs
 var PORT_BLOCK = 100;
@@ -31223,8 +31404,8 @@ function nextPortBlock(registry2) {
   return [base, base + PORT_SPAN];
 }
 function loadPortRegistry(path2) {
-  if (!(0, import_node_fs26.existsSync)(path2)) return {};
-  const raw = JSON.parse((0, import_node_fs26.readFileSync)(path2, "utf8"));
+  if (!(0, import_node_fs27.existsSync)(path2)) return {};
+  const raw = JSON.parse((0, import_node_fs27.readFileSync)(path2, "utf8"));
   const out = {};
   for (const [key, value] of Object.entries(raw)) {
     if (Array.isArray(value) && value.length === 2 && value.every((n) => typeof n === "number")) {
@@ -31252,22 +31433,22 @@ function existingPortRange(repo, registry2) {
   return registry2[repo] ?? null;
 }
 function portRangeInfraAt(root, source) {
-  const registryPath = (0, import_node_path25.join)(root, "infra", "port-ranges.json");
-  const ddbScriptPath = (0, import_node_path25.join)(root, "infra", "port-ddb.mjs");
-  if (!(0, import_node_fs26.existsSync)(registryPath) || !(0, import_node_fs26.existsSync)(ddbScriptPath)) return null;
+  const registryPath = (0, import_node_path26.join)(root, "infra", "port-ranges.json");
+  const ddbScriptPath = (0, import_node_path26.join)(root, "infra", "port-ddb.mjs");
+  if (!(0, import_node_fs27.existsSync)(registryPath) || !(0, import_node_fs27.existsSync)(ddbScriptPath)) return null;
   return { root, source, registryPath, ddbScriptPath };
 }
 function resolvePortRangeInfra(cwd, packageDir) {
   const direct = portRangeInfraAt(cwd, "cwd");
   if (direct) return direct;
-  for (let dir = cwd; ; dir = (0, import_node_path25.dirname)(dir)) {
-    const sibling = portRangeInfraAt((0, import_node_path25.join)(dir, "MMI-Hub"), "sibling-hub");
+  for (let dir = cwd; ; dir = (0, import_node_path26.dirname)(dir)) {
+    const sibling = portRangeInfraAt((0, import_node_path26.join)(dir, "MMI-Hub"), "sibling-hub");
     if (sibling) return sibling;
-    const parent = (0, import_node_path25.dirname)(dir);
+    const parent = (0, import_node_path26.dirname)(dir);
     if (parent === dir) break;
   }
   if (packageDir) {
-    const pkgRoot = (0, import_node_path25.join)(packageDir, "..", "..");
+    const pkgRoot = (0, import_node_path26.join)(packageDir, "..", "..");
     const pkgFrom = portRangeInfraAt(pkgRoot, "pkg-root");
     if (pkgFrom) return pkgFrom;
   }
@@ -31284,7 +31465,7 @@ async function ensurePortRangeAtomic(repo, path2, allocate) {
   } catch (e) {
     const why = e.message;
     const missing = /@aws-sdk\/[\w-]+/.exec(why)?.[0];
-    throw new Error(`DDB port allocator failed for ${repo} \u2014 refusing to fall back to the frozen ${path2} (it would hand out a block the cursor already gave away). ` + (missing && /cannot find|not found|ERR_MODULE_NOT_FOUND/i.test(why) ? `Missing dependency ${missing}: run \`npm ci\` in ${(0, import_node_path25.dirname)(path2)}, then retry.` : "Check AWS credentials and that the registry table is reachable, then retry.") + ` Cause: ${why}`);
+    throw new Error(`DDB port allocator failed for ${repo} \u2014 refusing to fall back to the frozen ${path2} (it would hand out a block the cursor already gave away). ` + (missing && /cannot find|not found|ERR_MODULE_NOT_FOUND/i.test(why) ? `Missing dependency ${missing}: run \`npm ci\` in ${(0, import_node_path26.dirname)(path2)}, then retry.` : "Check AWS credentials and that the registry table is reachable, then retry.") + ` Cause: ${why}`);
   }
 }
 
@@ -31336,13 +31517,13 @@ async function assignPersistedPortRange(repo, slug, reg, opts) {
 }
 
 // src/box-commands.ts
-var import_node_fs28 = require("node:fs");
+var import_node_fs29 = require("node:fs");
 var import_node_child_process10 = require("node:child_process");
-var import_node_os16 = require("node:os");
-var import_node_path27 = require("node:path");
+var import_node_os17 = require("node:os");
+var import_node_path28 = require("node:path");
 
 // src/box-control.ts
-var import_node_crypto9 = require("node:crypto");
+var import_node_crypto10 = require("node:crypto");
 var MANIFEST_PATH = "infra/box-control/manifest.json";
 var ALLOWED_POST = /* @__PURE__ */ new Set(["systemctl daemon-reload"]);
 function parseManifest(text) {
@@ -31389,7 +31570,7 @@ function filesForBox(files, box) {
   return files.flatMap((file) => file.targets.filter((t) => t.box === box).map((t) => ({ file, dest: t.dest })));
 }
 function md5(content) {
-  return (0, import_node_crypto9.createHash)("md5").update(content).digest("hex");
+  return (0, import_node_crypto10.createHash)("md5").update(content).digest("hex");
 }
 function planRemoteScript(dests) {
   const lines2 = ["set -u"];
@@ -31468,9 +31649,9 @@ function applyRemoteScript(items, date) {
 init_clean_exit();
 
 // src/secrets-commands.ts
-var import_node_fs27 = require("node:fs");
-var import_node_path26 = require("node:path");
-var import_node_os15 = require("node:os");
+var import_node_fs28 = require("node:fs");
+var import_node_path27 = require("node:path");
+var import_node_os16 = require("node:os");
 init_cli_shared();
 init_hub_auth();
 init_github_client();
@@ -32626,18 +32807,18 @@ function collectMap(value, previous = []) {
   return [...previous, value];
 }
 async function decryptRailsCredentials(input) {
-  const appDir = (0, import_node_path26.resolve)(input.appDir ?? process.cwd());
+  const appDir = (0, import_node_path27.resolve)(input.appDir ?? process.cwd());
   const credentialsFile = input.credentialsFile ?? DEFAULT_RAILS_CREDENTIALS_FILE;
   const masterKeyFile = input.masterKeyFile ?? DEFAULT_RAILS_MASTER_KEY_FILE;
-  const credentialsPath = (0, import_node_path26.resolve)(appDir, credentialsFile);
-  const masterKeyPath = (0, import_node_path26.resolve)(appDir, masterKeyFile);
+  const credentialsPath = (0, import_node_path27.resolve)(appDir, credentialsFile);
+  const masterKeyPath = (0, import_node_path27.resolve)(appDir, masterKeyFile);
   const env = {
     ...process.env,
     MMI_RAILS_CREDENTIALS_FILE: credentialsPath,
     MMI_RAILS_MASTER_KEY_FILE: masterKeyPath
   };
-  if ((0, import_node_fs27.existsSync)(masterKeyPath)) {
-    env.RAILS_MASTER_KEY = (0, import_node_fs27.readFileSync)(masterKeyPath, "utf8").trim();
+  if ((0, import_node_fs28.existsSync)(masterKeyPath)) {
+    env.RAILS_MASTER_KEY = (0, import_node_fs28.readFileSync)(masterKeyPath, "utf8").trim();
   }
   const script = [
     'require "json"',
@@ -32647,9 +32828,9 @@ async function decryptRailsCredentials(input) {
     'config = ActiveSupport::EncryptedConfiguration.new(config_path: config_path, key_path: key_path, env_key: "RAILS_MASTER_KEY", raise_if_missing_key: true)',
     "puts JSON.generate(config.config)"
   ].join("\n");
-  const scriptDir = (0, import_node_fs27.mkdtempSync)((0, import_node_path26.join)((0, import_node_os15.tmpdir)(), "mmi-rails-decrypt-"));
-  const scriptPath = (0, import_node_path26.join)(scriptDir, "decrypt.rb");
-  (0, import_node_fs27.writeFileSync)(scriptPath, script, "utf8");
+  const scriptDir = (0, import_node_fs28.mkdtempSync)((0, import_node_path27.join)((0, import_node_os16.tmpdir)(), "mmi-rails-decrypt-"));
+  const scriptPath = (0, import_node_path27.join)(scriptDir, "decrypt.rb");
+  (0, import_node_fs28.writeFileSync)(scriptPath, script, "utf8");
   try {
     const args = ["exec", "ruby", scriptPath];
     const cmd = process.platform === "win32" ? "cmd.exe" : "bundle";
@@ -32661,7 +32842,7 @@ async function decryptRailsCredentials(input) {
     });
     return JSON.parse(stdout);
   } finally {
-    (0, import_node_fs27.rmSync)(scriptDir, { recursive: true, force: true });
+    (0, import_node_fs28.rmSync)(scriptDir, { recursive: true, force: true });
   }
 }
 async function readSecretStdin() {
@@ -32751,7 +32932,7 @@ function registerSecretsCommands(program3) {
     let body;
     if (o.file) {
       try {
-        body = (0, import_node_fs27.readFileSync)((0, import_node_path26.resolve)(o.file), "utf8");
+        body = (0, import_node_fs28.readFileSync)((0, import_node_path27.resolve)(o.file), "utf8");
       } catch (e) {
         return fail(`secrets org-catalog: cannot read --file ${o.file}: ${e.message}`);
       }
@@ -32887,7 +33068,7 @@ function registerSecretsCommands(program3) {
       {
         ...d,
         decryptRailsCredentials,
-        removeFile: (path2) => (0, import_node_fs27.unlinkSync)((0, import_node_path26.resolve)(o.appDir ?? process.cwd(), path2))
+        removeFile: (path2) => (0, import_node_fs28.unlinkSync)((0, import_node_path27.resolve)(o.appDir ?? process.cwd(), path2))
       },
       {
         repo: o.repo,
@@ -33143,7 +33324,7 @@ function registerBoxCommands(program3) {
       }
       const remote = command && command.length ? command.join(" ") : void 0;
       const wroteScript = o.ssh && o.script ? o.script : null;
-      if (wroteScript) (0, import_node_fs28.writeFileSync)(wroteScript, sshRecipeScript(found, remote), "utf8");
+      if (wroteScript) (0, import_node_fs29.writeFileSync)(wroteScript, sshRecipeScript(found, remote), "utf8");
       if (o.json) {
         console.log(JSON.stringify({
           box: found,
@@ -33217,17 +33398,17 @@ function hubGitShow(ref) {
   return (path2) => git3(["show", `${ref}:${path2}`]);
 }
 function runOnBox(found, script) {
-  const dir = (0, import_node_fs28.mkdtempSync)((0, import_node_path27.join)((0, import_node_os16.tmpdir)(), "mmi-box-control-"));
+  const dir = (0, import_node_fs29.mkdtempSync)((0, import_node_path28.join)((0, import_node_os17.tmpdir)(), "mmi-box-control-"));
   try {
-    const recipe = (0, import_node_path27.join)(dir, "recipe.sh");
-    (0, import_node_fs28.writeFileSync)(recipe, sshRecipeScript(found, "sh -s"), "utf8");
+    const recipe = (0, import_node_path28.join)(dir, "recipe.sh");
+    (0, import_node_fs29.writeFileSync)(recipe, sshRecipeScript(found, "sh -s"), "utf8");
     const r = (0, import_node_child_process10.spawnSync)("bash", [recipe], { input: script, encoding: "utf8", maxBuffer: 16 * 1024 * 1024, timeout: 18e4, windowsHide: true });
     if (r.status !== 0) {
       throw new UnreadableError(`box control: the ssh session to ${found.name} failed (exit ${r.status ?? r.signal}): ${(r.stderr || "").trim().split("\n").slice(-3).join(" | ")}`);
     }
     return r.stdout;
   } finally {
-    (0, import_node_fs28.rmSync)(dir, { recursive: true, force: true });
+    (0, import_node_fs29.rmSync)(dir, { recursive: true, force: true });
   }
 }
 function formatControl(mode, box, rows) {
@@ -33355,7 +33536,7 @@ function renderDeployPortDoctor(report) {
 }
 
 // src/bootstrap-drift.ts
-var import_node_crypto10 = require("node:crypto");
+var import_node_crypto11 = require("node:crypto");
 function byteComparableSeeds(manifest, cls) {
   return manifest.seeds.filter((s) => s.ownership === "org" && s.source === "self" && s.classes.includes(cls));
 }
@@ -33375,7 +33556,7 @@ function compareSeedBytes(hubContent, repoContent) {
   return normalize(hubContent) === normalize(repoContent) ? "match" : "drift";
 }
 function seedContentHash(content) {
-  return (0, import_node_crypto10.createHash)("sha256").update(content.replace(/\r\n/g, "\n"), "utf8").digest("hex");
+  return (0, import_node_crypto11.createHash)("sha256").update(content.replace(/\r\n/g, "\n"), "utf8").digest("hex");
 }
 function auditRepoSeedDrift(repo, seeds, hubContents, repoReads) {
   const byTarget = new Map(repoReads.map((r) => [r.target, r.content]));
@@ -33538,7 +33719,7 @@ function renderPropagationReport(plan) {
 }
 
 // src/bootstrap-propagation-identity.ts
-var import_node_crypto11 = require("node:crypto");
+var import_node_crypto12 = require("node:crypto");
 var PROPAGATION_BRANCH_PREFIX = "seed-propagate-";
 var TARGET_MARKER_NAME = "mmi-bootstrap-propagation-target";
 function safeBranchPart(value, maxLength, fallback) {
@@ -33551,7 +33732,7 @@ function repoSlug2(repo) {
 function propagationBranch(repo, target) {
   const repoPart = safeBranchPart(repoSlug2(repo), 32, "repo");
   const targetPart = safeBranchPart(target, 48, "target");
-  const hash = (0, import_node_crypto11.createHash)("sha256").update(repo.trim().toLowerCase()).update("\0").update(target).digest("hex").slice(0, 12);
+  const hash = (0, import_node_crypto12.createHash)("sha256").update(repo.trim().toLowerCase()).update("\0").update(target).digest("hex").slice(0, 12);
   return `${PROPAGATION_BRANCH_PREFIX}${repoPart}-${targetPart}-${hash}`;
 }
 function legacyPropagationBranch(repo) {
@@ -34763,7 +34944,7 @@ function renderBootstrapVerifyReport(report) {
 }
 
 // src/bootstrap-seed-delivery.ts
-var import_node_crypto12 = require("node:crypto");
+var import_node_crypto13 = require("node:crypto");
 init_github_client();
 var SHA = /^[a-f0-9]{40}$/;
 async function readSeedFile(repo, target, ref, client) {
@@ -34796,7 +34977,7 @@ async function targetedSeedPlan(repo, slug, target, baseBranch, sourceSha, clien
   }
   const baseSha = base?.object?.sha;
   if (!baseSha || !SHA.test(baseSha) || !SHA.test(sourceSha)) throw new Error("bootstrap apply: seed identity is unreadable");
-  const identity = (0, import_node_crypto12.createHash)("sha256").update(JSON.stringify([repo.toLowerCase(), target, baseSha, sourceSha])).digest("hex").slice(0, 24);
+  const identity = (0, import_node_crypto13.createHash)("sha256").update(JSON.stringify([repo.toLowerCase(), target, baseSha, sourceSha])).digest("hex").slice(0, 24);
   const delivery = planSeedDelivery(rules, slug, baseBranch, `bootstrap-seed-${identity}`);
   const scoped = forcePr && delivery.mode === "direct" ? { mode: "pr", ref: `bootstrap-seed-${identity}-${slug}`, branch: `bootstrap-seed-${identity}-${slug}`, reason: "registry gate render requires review" } : delivery;
   return { ...scoped, baseSha, baseBranch };
@@ -34862,12 +35043,12 @@ async function verifyTargetedSeedPr(repo, number, plan, target, expected, client
 // src/bootstrap-commands.ts
 var execGitForSeedSource = async (args) => (await execFileP("git", args, { timeout: GIT_TIMEOUT_MS })).stdout;
 async function gateRenderDiff(current, rendered) {
-  const dir = (0, import_node_fs29.mkdtempSync)((0, import_node_path28.join)((0, import_node_os17.tmpdir)(), "mmi-gate-diff-"));
-  const before = (0, import_node_path28.join)(dir, "committed-gate.yml");
-  const after = (0, import_node_path28.join)(dir, "registry-render.yml");
+  const dir = (0, import_node_fs30.mkdtempSync)((0, import_node_path29.join)((0, import_node_os18.tmpdir)(), "mmi-gate-diff-"));
+  const before = (0, import_node_path29.join)(dir, "committed-gate.yml");
+  const after = (0, import_node_path29.join)(dir, "registry-render.yml");
   try {
-    (0, import_node_fs29.writeFileSync)(before, current);
-    (0, import_node_fs29.writeFileSync)(after, rendered);
+    (0, import_node_fs30.writeFileSync)(before, current);
+    (0, import_node_fs30.writeFileSync)(after, rendered);
     try {
       return (await execFileP("git", ["diff", "--no-index", "--", before, after], { timeout: GIT_TIMEOUT_MS })).stdout;
     } catch (e) {
@@ -34876,7 +35057,7 @@ async function gateRenderDiff(current, rendered) {
       throw e;
     }
   } finally {
-    (0, import_node_fs29.rmSync)(dir, { recursive: true, force: true });
+    (0, import_node_fs30.rmSync)(dir, { recursive: true, force: true });
   }
 }
 function bootstrapTrainDoctorDeps() {
@@ -34936,13 +35117,13 @@ function registerBootstrapCommands(program3) {
       })),
       pushAllowlistOwners: verifyOwners,
       pushAllowlistOwnersRead: verifyOwnersRead,
-      readLocalFile: (path2) => path2 === "projects.json" && apiProjects != null ? apiProjects : (0, import_node_fs29.existsSync)(path2) ? (0, import_node_fs29.readFileSync)(path2, "utf8") : null,
+      readLocalFile: (path2) => path2 === "projects.json" && apiProjects != null ? apiProjects : (0, import_node_fs30.existsSync)(path2) ? (0, import_node_fs30.readFileSync)(path2, "utf8") : null,
       // requiredGcpApis is stored as an array by a JSON write, but `org project set --var KEY=VALUE` stores a raw
       // comma-string — accept either so the seeded value verifies regardless of how it was written.
       // #3689: the same committed map the org access audit reads (#3664), so a sanctioned admin is not a
       // permanent bootstrap failure on one surface and an intended state on the other. Absent file → no
       // sanction, which is the pre-#3664 behaviour.
-      sanctionedAdmins: (0, import_node_fs29.existsSync)("access-matrix.json") ? entriesValueByCanonicalRepo(loadSanctionedAdmins((0, import_node_fs29.readFileSync)("access-matrix.json", "utf8")), repo) : void 0,
+      sanctionedAdmins: (0, import_node_fs30.existsSync)("access-matrix.json") ? entriesValueByCanonicalRepo(loadSanctionedAdmins((0, import_node_fs30.readFileSync)("access-matrix.json", "utf8")), repo) : void 0,
       requiredGcpApis: (() => {
         const v = meta?.requiredGcpApis;
         if (Array.isArray(v)) return v;
@@ -35020,14 +35201,14 @@ function registerBootstrapCommands(program3) {
   bootstrap.command("drift").description("#3818: compare every org-owned whole-file seed against MMI-Hub's copy across the registry roster; read-only").option("--repo <owner/repo>", "audit one repo instead of the roster (never a fleet verdict)").option("--json", "machine-readable output").action(async () => {
     const o = { repo: rawValue("--repo", ""), json: rawFlag("--json") };
     const manifestPath = "skills/bootstrap/seeds/manifest.json";
-    if (!(0, import_node_fs29.existsSync)(manifestPath)) return fail(`bootstrap drift: ${manifestPath} not found; run from the MMI-Hub repo root \u2014 the Hub's copies ARE the reference this compares against`);
+    if (!(0, import_node_fs30.existsSync)(manifestPath)) return fail(`bootstrap drift: ${manifestPath} not found; run from the MMI-Hub repo root \u2014 the Hub's copies ARE the reference this compares against`);
     const seedSource = await resolveHubSeedSource(execGitForSeedSource);
     if (!seedSource.ok) return fail(`bootstrap drift: ${seedSource.reason}`);
-    const manifest = loadBootstrapSeeds((0, import_node_fs29.readFileSync)(manifestPath, "utf8"));
+    const manifest = loadBootstrapSeeds((0, import_node_fs30.readFileSync)(manifestPath, "utf8"));
     const hubContents = /* @__PURE__ */ new Map();
     for (const s of manifest.seeds) {
       if (s.ownership !== "org" || s.source !== "self") continue;
-      hubContents.set(s.target, (0, import_node_fs29.existsSync)(s.target) ? (0, import_node_fs29.readFileSync)(s.target, "utf8") : null);
+      hubContents.set(s.target, (0, import_node_fs30.existsSync)(s.target) ? (0, import_node_fs30.readFileSync)(s.target, "utf8") : null);
     }
     let targets;
     let classOf = (_repo) => "deployable";
@@ -35235,24 +35416,24 @@ function registerBootstrapCommands(program3) {
       return;
     }
     const manifestPath = "skills/bootstrap/seeds/manifest.json";
-    if (!(0, import_node_fs29.existsSync)(manifestPath)) return fail(`bootstrap apply: ${manifestPath} not found; bootstrap runs from the MMI-Hub repo root by design \u2014 it stamps org-level resources (Project, Ruleset, secrets, access) through the GitHub App, which is only authorized from the Hub checkout`);
+    if (!(0, import_node_fs30.existsSync)(manifestPath)) return fail(`bootstrap apply: ${manifestPath} not found; bootstrap runs from the MMI-Hub repo root by design \u2014 it stamps org-level resources (Project, Ruleset, secrets, access) through the GitHub App, which is only authorized from the Hub checkout`);
     const seedSource = await resolveHubSeedSource(execGitForSeedSource);
     if (!seedSource.ok) return fail(`bootstrap apply: ${seedSource.reason}`);
-    const manifest = loadBootstrapSeeds((0, import_node_fs29.readFileSync)(manifestPath, "utf8"));
+    const manifest = loadBootstrapSeeds((0, import_node_fs30.readFileSync)(manifestPath, "utf8"));
     const baseBranch = o.class === "content" ? "main" : "development";
     const slug = parsedRepo.slug;
     const onlyTarget = o.fromConfig && o.only.trim() === "gate.yml" ? ".github/workflows/gate.yml" : o.only.trim();
     const gh2 = async (args) => execFileP("gh", args, { timeout: 2e4 });
-    const readFile10 = (p) => (0, import_node_fs29.existsSync)(p) ? (0, import_node_fs29.readFileSync)(p, "utf8") : null;
+    const readFile10 = (p) => (0, import_node_fs30.existsSync)(p) ? (0, import_node_fs30.readFileSync)(p, "utf8") : null;
     const enc = (p) => p.split("/").map(encodeURIComponent).join("/");
     const putSeed = async (target, content, ref, sha) => {
-      const tmp = (0, import_node_path28.join)((0, import_node_os17.tmpdir)(), `mmi-seed-${process.pid}-${Date.now().toString(36)}-${Math.random().toString(36).slice(2)}.json`);
-      (0, import_node_fs29.writeFileSync)(tmp, JSON.stringify(contentPutBody(target, content, ref, sha)), "utf8");
+      const tmp = (0, import_node_path29.join)((0, import_node_os18.tmpdir)(), `mmi-seed-${process.pid}-${Date.now().toString(36)}-${Math.random().toString(36).slice(2)}.json`);
+      (0, import_node_fs30.writeFileSync)(tmp, JSON.stringify(contentPutBody(target, content, ref, sha)), "utf8");
       try {
         await gh2(contentPutInputArgs(repo, target, tmp));
       } finally {
         try {
-          (0, import_node_fs29.unlinkSync)(tmp);
+          (0, import_node_fs30.unlinkSync)(tmp);
         } catch {
         }
       }
@@ -35888,10 +36069,10 @@ LIVE apply to ${repo}:
   bootstrap.command("propagate").description("#4238: re-entrant canary\u2192wave tick \u2014 plan (or, with --execute, open) per-repo PRs fanning an org-owned seed out to the fleet").option("--target <path>", "the manifest target to propagate (an org-owned whole file or declared Hub-managed block)").option("--execute", "LIVE tick via gh (master-gated) \u2014 opens/reuses per-repo seed-propagate PRs; dry-run prints the plan only").option("--json", "machine-readable output").action(async () => {
     const o = { target: rawValue("--target", ""), execute: rawFlag("--execute"), json: rawFlag("--json") };
     const manifestPath = "skills/bootstrap/seeds/manifest.json";
-    if (!(0, import_node_fs29.existsSync)(manifestPath)) return fail(`bootstrap propagate: ${manifestPath} not found; run from the MMI-Hub repo root \u2014 the Hub's copies ARE the desired state this tick propagates`);
+    if (!(0, import_node_fs30.existsSync)(manifestPath)) return fail(`bootstrap propagate: ${manifestPath} not found; run from the MMI-Hub repo root \u2014 the Hub's copies ARE the desired state this tick propagates`);
     const seedSource = await resolveHubSeedSource(execGitForSeedSource);
     if (!seedSource.ok) return fail(`bootstrap propagate: ${seedSource.reason}`);
-    const manifest = loadBootstrapSeeds((0, import_node_fs29.readFileSync)(manifestPath, "utf8"));
+    const manifest = loadBootstrapSeeds((0, import_node_fs30.readFileSync)(manifestPath, "utf8"));
     const propagatable = manifest.seeds.filter(isPropagatableSeed);
     if (!o.target) {
       return fail(`bootstrap propagate: --target <path> is required \u2014 one of:
@@ -35900,9 +36081,9 @@ LIVE apply to ${repo}:
     const seed = propagatable.find((s) => s.target === o.target);
     if (!seed) return fail(`bootstrap propagate: --target '${o.target}' names no centrally propagatable seed in ${manifestPath}. Propagatable targets:
   ${propagatable.map((s) => s.target).join("\n  ")}`);
-    if (!seed.managedBlock && !(0, import_node_fs29.existsSync)(seed.target)) return fail(`bootstrap propagate: the Hub's own copy of '${seed.target}' is missing \u2014 nothing to propagate`);
-    const hubContent = seed.managedBlock ? null : (0, import_node_fs29.readFileSync)(seed.target, "utf8");
-    const readSeedFile2 = (path2) => (0, import_node_fs29.existsSync)(path2) ? (0, import_node_fs29.readFileSync)(path2, "utf8") : null;
+    if (!seed.managedBlock && !(0, import_node_fs30.existsSync)(seed.target)) return fail(`bootstrap propagate: the Hub's own copy of '${seed.target}' is missing \u2014 nothing to propagate`);
+    const hubContent = seed.managedBlock ? null : (0, import_node_fs30.readFileSync)(seed.target, "utf8");
+    const readSeedFile2 = (path2) => (0, import_node_fs30.existsSync)(path2) ? (0, import_node_fs30.readFileSync)(path2, "utf8") : null;
     const isWorkflowSeed = seed.target.startsWith(".github/workflows/");
     const cfg = await loadConfig();
     const projects = await fetchProjectsList(registryClientDeps(cfg));
@@ -35911,9 +36092,9 @@ LIVE apply to ${repo}:
     }
     const rosterRepos = collectRegistryRepos(projects).filter((r) => r.toLowerCase() !== "mutmutco/mmi-hub");
     let independentCount = rosterRepos.length;
-    if ((0, import_node_fs29.existsSync)("projects.json")) {
+    if ((0, import_node_fs30.existsSync)("projects.json")) {
       try {
-        const local = JSON.parse((0, import_node_fs29.readFileSync)("projects.json", "utf8"));
+        const local = JSON.parse((0, import_node_fs30.readFileSync)("projects.json", "utf8"));
         const localRepos = /* @__PURE__ */ new Set();
         for (const p of local.projects ?? []) for (const r of p.repos ?? []) {
           const full = (r.includes("/") ? r : `mutmutco/${r}`).toLowerCase();
@@ -36083,15 +36264,15 @@ LIVE apply to ${repo}:
         } catch {
           existingSha = void 0;
         }
-        const tmp = (0, import_node_path28.join)((0, import_node_os17.tmpdir)(), `mmi-propagate-${process.pid}-${Date.now().toString(36)}-${Math.random().toString(36).slice(2)}.json`);
+        const tmp = (0, import_node_path29.join)((0, import_node_os18.tmpdir)(), `mmi-propagate-${process.pid}-${Date.now().toString(36)}-${Math.random().toString(36).slice(2)}.json`);
         const desiredContent = desiredByRepo.get(rec.repo);
         if (desiredContent == null) return fail(`bootstrap propagate: no resolved content for ${rec.repo} ${seed.target} \u2014 refusing to write`);
-        (0, import_node_fs29.writeFileSync)(tmp, JSON.stringify(contentPutBody(seed.target, desiredContent, branch, existingSha)), "utf8");
+        (0, import_node_fs30.writeFileSync)(tmp, JSON.stringify(contentPutBody(seed.target, desiredContent, branch, existingSha)), "utf8");
         try {
           await gh2(contentPutInputArgs(rec.repo, seed.target, tmp));
         } finally {
           try {
-            (0, import_node_fs29.unlinkSync)(tmp);
+            (0, import_node_fs30.unlinkSync)(tmp);
           } catch {
           }
         }
@@ -36160,10 +36341,10 @@ Rollback: \`mmi-cli devops bootstrap rollback ${rec.repo} --target ${seed.target
       return fail(`bootstrap rollback: ${e.message}`);
     }
     const manifestPath = "skills/bootstrap/seeds/manifest.json";
-    if (!(0, import_node_fs29.existsSync)(manifestPath)) return fail(`bootstrap rollback: ${manifestPath} not found; run from the MMI-Hub repo root \u2014 the manifest names which targets are org-owned and therefore propagated (and rollback-able)`);
+    if (!(0, import_node_fs30.existsSync)(manifestPath)) return fail(`bootstrap rollback: ${manifestPath} not found; run from the MMI-Hub repo root \u2014 the manifest names which targets are org-owned and therefore propagated (and rollback-able)`);
     const seedSource = await resolveHubSeedSource(execGitForSeedSource);
     if (!seedSource.ok) return fail(`bootstrap rollback: ${seedSource.reason}`);
-    const manifest = loadBootstrapSeeds((0, import_node_fs29.readFileSync)(manifestPath, "utf8"));
+    const manifest = loadBootstrapSeeds((0, import_node_fs30.readFileSync)(manifestPath, "utf8"));
     const propagatable = manifest.seeds.filter(isPropagatableSeed);
     if (!o.target) {
       return fail(`bootstrap rollback: --target <path> is required \u2014 one of:
@@ -36180,10 +36361,10 @@ Rollback: \`mmi-cli devops bootstrap rollback ${rec.repo} --target ${seed.target
     const enc = (p) => p.split("/").map(encodeURIComponent).join("/");
     let candidates;
     if (o.record) {
-      if (!(0, import_node_fs29.existsSync)(o.record)) return fail(`bootstrap rollback: --record '${o.record}' not found`);
+      if (!(0, import_node_fs30.existsSync)(o.record)) return fail(`bootstrap rollback: --record '${o.record}' not found`);
       let parsed;
       try {
-        parsed = JSON.parse((0, import_node_fs29.readFileSync)(o.record, "utf8"));
+        parsed = JSON.parse((0, import_node_fs30.readFileSync)(o.record, "utf8"));
       } catch (e) {
         return fail(`bootstrap rollback: --record '${o.record}' is not valid JSON: ${e.message}`);
       }
@@ -36260,13 +36441,13 @@ Rollback: \`mmi-cli devops bootstrap rollback ${rec.repo} --target ${seed.target
       } catch {
         existingSha = void 0;
       }
-      const tmp = (0, import_node_path28.join)((0, import_node_os17.tmpdir)(), `mmi-rollback-${process.pid}-${Date.now().toString(36)}-${Math.random().toString(36).slice(2)}.json`);
-      (0, import_node_fs29.writeFileSync)(tmp, JSON.stringify(contentPutBody(seed.target, preSeedContent, plan.branch, existingSha)), "utf8");
+      const tmp = (0, import_node_path29.join)((0, import_node_os18.tmpdir)(), `mmi-rollback-${process.pid}-${Date.now().toString(36)}-${Math.random().toString(36).slice(2)}.json`);
+      (0, import_node_fs30.writeFileSync)(tmp, JSON.stringify(contentPutBody(seed.target, preSeedContent, plan.branch, existingSha)), "utf8");
       try {
         await gh2(contentPutInputArgs(repo, seed.target, tmp));
       } finally {
         try {
-          (0, import_node_fs29.unlinkSync)(tmp);
+          (0, import_node_fs30.unlinkSync)(tmp);
         } catch {
         }
       }
@@ -36442,7 +36623,7 @@ init_github_client();
 init_cli_shared();
 
 // src/suite-status.ts
-var import_node_crypto13 = require("node:crypto");
+var import_node_crypto14 = require("node:crypto");
 var SUITE_REPO = "mutmutco/MM-Work";
 var REPOS = {
   "mmi-scout": "mutmutco/MMI-Scout",
@@ -36470,7 +36651,7 @@ function parseSuiteMapping(body) {
     return void 0;
   }
 }
-var sha256 = (b) => (0, import_node_crypto13.createHash)("sha256").update(b).digest("hex");
+var sha256 = (b) => (0, import_node_crypto14.createHash)("sha256").update(b).digest("hex");
 async function proveBundle(url, tag, fetchUrl) {
   const get = async (u) => {
     try {
@@ -36723,9 +36904,9 @@ async function waitSuiteDev(deps, opts) {
 }
 
 // src/suite-train.ts
-var import_node_fs30 = require("node:fs");
-var import_node_path29 = require("node:path");
-var import_node_crypto14 = require("node:crypto");
+var import_node_fs31 = require("node:fs");
+var import_node_path30 = require("node:path");
+var import_node_crypto15 = require("node:crypto");
 
 // src/kit-version.ts
 var parse = (v) => /^(\d+)\.(\d+)\.(\d+)(-.+)?$/.exec(typeof v === "string" ? v.trim() : "");
@@ -36810,7 +36991,7 @@ function suiteReleaseTag(rc) {
 function readSuiteCut(path2) {
   let raw;
   try {
-    raw = (0, import_node_fs30.readFileSync)(path2, "utf8");
+    raw = (0, import_node_fs31.readFileSync)(path2, "utf8");
   } catch (e) {
     if (e.code === "ENOENT") return void 0;
     throw e;
@@ -36826,11 +37007,11 @@ function readSuiteCut(path2) {
   return record;
 }
 function writeSuiteCut(path2, record) {
-  (0, import_node_fs30.mkdirSync)((0, import_node_path29.dirname)(path2), { recursive: true });
-  const temp = `${path2}.${(0, import_node_crypto14.randomBytes)(8).toString("hex")}.tmp`;
+  (0, import_node_fs31.mkdirSync)((0, import_node_path30.dirname)(path2), { recursive: true });
+  const temp = `${path2}.${(0, import_node_crypto15.randomBytes)(8).toString("hex")}.tmp`;
   try {
-    (0, import_node_fs30.writeFileSync)(temp, JSON.stringify(record, null, 2), { flag: "wx" });
-    (0, import_node_fs30.renameSync)(temp, path2);
+    (0, import_node_fs31.writeFileSync)(temp, JSON.stringify(record, null, 2), { flag: "wx" });
+    (0, import_node_fs31.renameSync)(temp, path2);
   } catch (e) {
     throw new Error(`suite cut record write failed at ${path2}: ${e.message}; stop, verify the file before retrying`);
   }
@@ -36879,25 +37060,25 @@ async function suiteMarkAbandoned(deps, ownerGo = false) {
   return tags.map((t) => `${t.repo}@${t.tag}`);
 }
 async function retireFailedLeadRcLedger(deps, ownerGo) {
-  if (!(0, import_node_fs30.existsSync)(deps.ledgerPath)) return void 0;
+  if (!(0, import_node_fs31.existsSync)(deps.ledgerPath)) return void 0;
   return withLedgerLock(deps.ledgerPath, async (fence) => {
-    const ledger = parseReleaseLedger((0, import_node_fs30.readFileSync)(deps.ledgerPath, "utf8"));
+    const ledger = parseReleaseLedger((0, import_node_fs31.readFileSync)(deps.ledgerPath, "utf8"));
     const states = Object.values(ledger.phases).map((p) => p.state);
     if (ledger.repo !== SUITE_REPO || ledger.lane !== "rcand" || ledger.phases.promotion.state === "complete" || !states.includes("failed")) return void 0;
     if (!ownerGo) throw new Error(`the lead's failed rcand ledger for ${ledger.tag} blocks every train; retire it with suite abandon --owner-go`);
     if ((await deps.rcHead())?.toLowerCase() === ledger.tagSha.toLowerCase()) throw new Error(`origin rc already points at ${ledger.tag}; it was promoted, so its ledger is not retired`);
-    const archive = (0, import_node_path29.join)((0, import_node_path29.dirname)(deps.ledgerPath), `phases.archive-${ledger.tag}.json`);
-    if ((0, import_node_fs30.existsSync)(archive)) throw new Error(`ledger archive already exists at ${archive}; inspect before retiring again`);
+    const archive = (0, import_node_path30.join)((0, import_node_path30.dirname)(deps.ledgerPath), `phases.archive-${ledger.tag}.json`);
+    if ((0, import_node_fs31.existsSync)(archive)) throw new Error(`ledger archive already exists at ${archive}; inspect before retiring again`);
     await deps.markAbandoned(SUITE_REPO, ledger.tag, ledger.tagSha);
-    await fence(() => (0, import_node_fs30.renameSync)(deps.ledgerPath, archive));
+    await fence(() => (0, import_node_fs31.renameSync)(deps.ledgerPath, archive));
     return `${ledger.tag} (ledger archived to ${archive})`;
   });
 }
 function suiteAbandon(recordPath, ownerGo = false, now = /* @__PURE__ */ new Date()) {
   const record = abandonableCut(recordPath, ownerGo);
   const archive = `${recordPath}.abandoned-${record.leadDevelopment.slice(0, 12)}-${now.toISOString().replace(/[:.]/g, "")}.json`;
-  if ((0, import_node_fs30.existsSync)(archive)) throw new Error(`abandoned-cut archive already exists at ${archive}; inspect before abandoning again`);
-  (0, import_node_fs30.renameSync)(recordPath, archive);
+  if ((0, import_node_fs31.existsSync)(archive)) throw new Error(`abandoned-cut archive already exists at ${archive}; inspect before abandoning again`);
+  (0, import_node_fs31.renameSync)(recordPath, archive);
   return { archive, orphanTags: record.members.filter((m) => m.tag).map((m) => `${m.repo}@${m.tag}`) };
 }
 async function suiteRestoreMainPins(deps) {
@@ -36963,12 +37144,12 @@ async function suiteRcand(deps, opts) {
   }
   if ((record?.announcement === "sent" || record?.announcement === "skipped") && record.leadReleased) {
     const archive = `${deps.recordPath}.${record.leadRcTag}.json`;
-    if ((0, import_node_fs30.existsSync)(archive)) throw new Error(`suite cut archive already exists at ${archive}; inspect before a new cut`);
-    (0, import_node_fs30.renameSync)(deps.recordPath, archive);
+    if ((0, import_node_fs31.existsSync)(archive)) throw new Error(`suite cut archive already exists at ${archive}; inspect before a new cut`);
+    (0, import_node_fs31.renameSync)(deps.recordPath, archive);
     record = void 0;
   }
   if (record && !record.pinPr && !record.leadRcTag && record.members.every((m) => !m.tag)) {
-    (0, import_node_fs30.rmSync)(deps.recordPath, { force: true });
+    (0, import_node_fs31.rmSync)(deps.recordPath, { force: true });
     record = void 0;
   }
   if (!record) {
@@ -37022,7 +37203,7 @@ async function suiteRcand(deps, opts) {
     quiet.push(member);
   }
   if (record.members.every((m) => m.carried || quiet.includes(m)) && await deps.contains(SUITE_REPO, record.leadDevelopment, record.leadPreviousRc)) {
-    (0, import_node_fs30.rmSync)(deps.recordPath, { force: true });
+    (0, import_node_fs31.rmSync)(deps.recordPath, { force: true });
     throw new Error("nothing to promote: neither MM-Work nor any module has new development commits since its rc; no suite cut started");
   }
   for (const member of quiet) {
@@ -37040,7 +37221,7 @@ async function suiteRcand(deps, opts) {
   }
   if (refusals.length) {
     const untouched = record.members.every((m) => !m.tag) && !record.pinPr;
-    if (untouched) (0, import_node_fs30.rmSync)(deps.recordPath, { force: true });
+    if (untouched) (0, import_node_fs31.rmSync)(deps.recordPath, { force: true });
     throw new Error(`module rc serving is not ready; ${untouched ? "no suite cut started" : "no new tag was cut"}:
 ${refusals.join("\n")}
 Each module must ship a live release that bind-mounts <deployPath>/data read-only and serves <data>/rc/module.js at /rc/module.js (docs/Guides/suite-trains.md).`);
@@ -37197,11 +37378,11 @@ Each member's live release must serve <data>/main/module.js at its main pin path
   }
   return record;
 }
-var hotfixRecordPath = (deps) => (0, import_node_path29.join)((0, import_node_path29.dirname)(deps.recordPath), "hotfix.json");
+var hotfixRecordPath = (deps) => (0, import_node_path30.join)((0, import_node_path30.dirname)(deps.recordPath), "hotfix.json");
 function readSuiteHotfix(path2) {
   let raw;
   try {
-    raw = (0, import_node_fs30.readFileSync)(path2, "utf8");
+    raw = (0, import_node_fs31.readFileSync)(path2, "utf8");
   } catch (e) {
     if (e.code === "ENOENT") return void 0;
     throw e;
@@ -37244,7 +37425,7 @@ async function suiteHotfix(deps, opts) {
   if (completed) record = void 0;
   if (record && record.repo !== found.repo) throw new Error(`an unfinished suite hotfix for ${record.repo} is recorded; finish it (rerun with that member) first`);
   if (!record?.tag) await deps.validateHotfixSummary();
-  if (completed) (0, import_node_fs30.renameSync)(path2, `${path2}.${completed.leadTag}.json`);
+  if (completed) (0, import_node_fs31.renameSync)(path2, `${path2}.${completed.leadTag}.json`);
   const rec = record ?? { schema: "mmi-suite-hotfix/v1", member: found.id, repo: found.repo, from: opts.from, ...opts.ack?.length ? { ack: opts.ack } : {} };
   const save = () => writeSuiteHotfix(path2, rec);
   save();
@@ -37511,8 +37692,8 @@ async function runRcDataSwitch(deps, opts) {
 }
 
 // src/suite-train-io.ts
-var import_node_fs44 = require("node:fs");
-var import_node_path43 = require("node:path");
+var import_node_fs45 = require("node:fs");
+var import_node_path44 = require("node:path");
 init_cli_shared();
 
 // src/command-register-train-operations.ts
@@ -37867,8 +38048,8 @@ async function preflightHotfixBatchPicks(deps, sources, pickTolerated) {
   if (sources.length === 0) return { failures: [], skipped: [] };
   const { mkdtemp: mkdtemp2, rm: rm2 } = await import("node:fs/promises");
   const { tmpdir: tmpdir12 } = await import("node:os");
-  const { join: join47 } = await import("node:path");
-  const dir = await mkdtemp2(join47(tmpdir12(), "mmi-hotfix-preflight-"));
+  const { join: join48 } = await import("node:path");
+  const dir = await mkdtemp2(join48(tmpdir12(), "mmi-hotfix-preflight-"));
   const wt = { run: (file, args) => deps.run(file, file === "git" ? ["-C", dir, ...args] : args) };
   const failures = [];
   const skipped = [];
@@ -39189,9 +39370,9 @@ function checkHotfixCarries(options) {
 }
 
 // src/merge-cleanup.ts
-var import_node_fs32 = require("node:fs");
-var import_node_path31 = require("node:path");
-var import_node_os18 = require("node:os");
+var import_node_fs33 = require("node:fs");
+var import_node_path32 = require("node:path");
+var import_node_os19 = require("node:os");
 init_cli_shared();
 init_github_client();
 
@@ -39505,8 +39686,8 @@ async function runPrLand(prNumber, options, deps) {
 
 // src/test-policy-core.ts
 var import_node_child_process13 = require("node:child_process");
-var import_node_fs31 = require("node:fs");
-var import_node_path30 = require("node:path");
+var import_node_fs32 = require("node:fs");
+var import_node_path31 = require("node:path");
 
 // src/test-command-policy-shared.mjs
 var import_node_child_process12 = require("node:child_process");
@@ -39982,7 +40163,7 @@ function isMeaningfulRow(file) {
   return file.meaningful !== false;
 }
 function loadPolicy(root, readFile10 = readFileOrNull2) {
-  const raw = readFile10((0, import_node_path30.join)(root, POLICY_FILE));
+  const raw = readFile10((0, import_node_path31.join)(root, POLICY_FILE));
   if (raw == null) return { mandatory: [], declared: false };
   return parsePolicy(raw, POLICY_FILE);
 }
@@ -40059,7 +40240,7 @@ function loadPolicySource(root, explicitRef, diffBase) {
 }
 function readFileOrNull2(path2) {
   try {
-    return (0, import_node_fs31.readFileSync)(path2, "utf8");
+    return (0, import_node_fs32.readFileSync)(path2, "utf8");
   } catch {
     return null;
   }
@@ -40087,12 +40268,12 @@ function classify(changed, policy, present = () => false) {
   const removedProtected = [...removed].filter((p) => protectedBy.has(p)).map((p) => ({ path: p, why: protectedBy.get(p) ?? "" }));
   return { mandatoryHits, untestedHits, testChanges, meaningfulTestChanges, addedTests, removedProtected };
 }
-function unresolvedProtectedEntries(policy, root, exists = (path2) => (0, import_node_fs31.existsSync)(path2)) {
-  return (policy.protected ?? []).map((p) => p.path).filter((p) => !exists((0, import_node_path30.join)(root, p)));
+function unresolvedProtectedEntries(policy, root, exists = (path2) => (0, import_node_fs32.existsSync)(path2)) {
+  return (policy.protected ?? []).map((p) => p.path).filter((p) => !exists((0, import_node_path31.join)(root, p)));
 }
-function unresolvedSatisfiers(policy, root, exists = (path2) => (0, import_node_fs31.existsSync)(path2)) {
+function unresolvedSatisfiers(policy, root, exists = (path2) => (0, import_node_fs32.existsSync)(path2)) {
   const declared = (policy.mandatory ?? []).flatMap((m) => m.satisfiedBy ?? []);
-  return [...new Set(declared)].filter((p) => !exists((0, import_node_path30.join)(root, p)));
+  return [...new Set(declared)].filter((p) => !exists((0, import_node_path31.join)(root, p)));
 }
 function evaluate(changed, policy, present = () => false) {
   const { mandatoryHits, untestedHits, meaningfulTestChanges, addedTests, removedProtected } = classify(changed, policy, present);
@@ -40231,14 +40412,14 @@ function runTestPolicy(root, deps = {}) {
   }
   const loaded = deps.policy ? { policy: deps.policy, source: { ref: null, sha: null, path: POLICY_FILE } } : loadPolicySource(root, deps.policyRef, deps.base);
   const { policy, source: policySource } = loaded;
-  const exists = deps.exists ?? ((path2) => (0, import_node_fs31.existsSync)(path2));
+  const exists = deps.exists ?? ((path2) => (0, import_node_fs32.existsSync)(path2));
   const counts = { mandatoryCount: (policy.mandatory ?? []).length, protectedCount: (policy.protected ?? []).length };
   const base = deps.changed ? "(injected)" : deps.policyRef ? resolveHotfixBase(root) : resolveBase(root, deps.base);
   const refusal = deps.changed ? null : untrustworthyRange(root, base);
   const raw = deps.changed ?? (refusal ? [] : changedFilesSince(base, root));
   const changed = deps.changed ? raw : annotateChangeMeaning(raw, policy, (path2) => ({
     before: blobAt(base, path2, root),
-    after: readFileOrNull2((0, import_node_path30.join)(root, path2))
+    after: readFileOrNull2((0, import_node_path31.join)(root, path2))
   }));
   const lookup = deps.override !== void 0 ? { override: deps.override, refusals: [] } : !deps.changed && !refusal ? readOverride2(base, root) : { override: null, refusals: [] };
   const policyRefusals = policy.declared === false ? [{
@@ -40248,8 +40429,8 @@ function runTestPolicy(root, deps = {}) {
   A gate with no policy cannot decide which test commands are required or permitted.
 ` + (deps.base === HOTFIX_DIFF_BASE ? `  Hotfix lane (--base ${HOTFIX_DIFF_BASE}): pass --policy-ref <exact-${HOTFIX_POLICY_REF}-commit> so the current policy is read from ${HOTFIX_POLICY_REF}.` : `  Restore ${POLICY_FILE} on this branch; the policy file belongs on every non-hotfix lane.`)
   }] : [];
-  const present = (path2) => exists((0, import_node_path30.join)(root, path2));
-  const policyTree = policySource.sha ? new Set(git2(["ls-tree", "-r", "-z", "--name-only", policySource.sha], root).split("\0").filter(Boolean).map((p) => (0, import_node_path30.join)(root, p))) : null;
+  const present = (path2) => exists((0, import_node_path31.join)(root, path2));
+  const policyTree = policySource.sha ? new Set(git2(["ls-tree", "-r", "-z", "--name-only", policySource.sha], root).split("\0").filter(Boolean).map((p) => (0, import_node_path31.join)(root, p))) : null;
   const policyTreeExists = policyTree ? (abs) => policyTree.has(abs) : exists;
   const where = policySource.sha ? `${policySource.ref}@${policySource.sha}` : "this worktree";
   const removedByThisDiff = removedPaths(changed);
@@ -40529,13 +40710,13 @@ function resolveSquashMergeBodyText(commits, allowedClosing, cwd) {
   return rewritten === base ? null : rewritten;
 }
 function writeSquashBodyFile(body) {
-  const dir = (0, import_node_fs32.mkdtempSync)((0, import_node_path31.join)((0, import_node_os18.tmpdir)(), "mmi-squash-body-"));
-  const path2 = (0, import_node_path31.join)(dir, "body.txt");
-  (0, import_node_fs32.writeFileSync)(path2, body.endsWith("\n") ? body : `${body}
+  const dir = (0, import_node_fs33.mkdtempSync)((0, import_node_path32.join)((0, import_node_os19.tmpdir)(), "mmi-squash-body-"));
+  const path2 = (0, import_node_path32.join)(dir, "body.txt");
+  (0, import_node_fs33.writeFileSync)(path2, body.endsWith("\n") ? body : `${body}
 `, "utf8");
   return { path: path2, cleanup: () => {
     try {
-      (0, import_node_fs32.rmSync)(dir, { recursive: true, force: true });
+      (0, import_node_fs33.rmSync)(dir, { recursive: true, force: true });
     } catch {
     }
   } };
@@ -40742,8 +40923,8 @@ async function deleteMergedRemoteBranch(options) {
 }
 
 // src/project-info-sync.ts
-var import_node_fs33 = require("node:fs");
-var import_node_path32 = require("node:path");
+var import_node_fs34 = require("node:fs");
+var import_node_path33 = require("node:path");
 var UPDATE_PROJECT_INFO = `mutation($projectId: ID!, $shortDescription: String!, $readme: String!) {
   updateProjectV2(input: { projectId: $projectId, shortDescription: $shortDescription, readme: $readme }) {
     projectV2 { id }
@@ -40790,14 +40971,14 @@ function sharedName(entries, fallback) {
 }
 function buildProjectInfoSyncPlan(targetRepo2, project2, projects, repoRoot2) {
   if (!project2.projectId) throw new Error(`org project sync-info: ${targetRepo2} registry META has no projectId`);
-  const readmePath = (0, import_node_path32.join)(repoRoot2, "README.md");
-  if (!(0, import_node_fs33.existsSync)(readmePath)) throw new Error(`org project sync-info: ${targetRepo2} has no README.md`);
+  const readmePath = (0, import_node_path33.join)(repoRoot2, "README.md");
+  if (!(0, import_node_fs34.existsSync)(readmePath)) throw new Error(`org project sync-info: ${targetRepo2} has no README.md`);
   const entries = entriesFor(project2, projects);
   const memberRepos = [...new Set(entries.flatMap((entry) => entry.repos ?? []))].filter((repo) => /^[^/]+\/[^/]+$/.test(repo)).sort((a, b) => a.localeCompare(b));
   const projectName = sharedName(entries, project2.name?.trim() || targetRepo2.split("/").pop() || targetRepo2);
   if (!memberRepos.length) throw new Error(`org project sync-info: project ${projectName} has no registered member repos`);
   const entryNames = entries.map((entry) => entry.name?.trim()).filter((name) => Boolean(name));
-  const shortDescription = memberRepos.length === 1 ? shortDescriptionFromReadme((0, import_node_fs33.readFileSync)(readmePath, "utf8")) : `Shared work across ${new Intl.ListFormat("en", { type: "conjunction" }).format(entryNames)}.`;
+  const shortDescription = memberRepos.length === 1 ? shortDescriptionFromReadme((0, import_node_fs34.readFileSync)(readmePath, "utf8")) : `Shared work across ${new Intl.ListFormat("en", { type: "conjunction" }).format(entryNames)}.`;
   const lines2 = [
     `# ${projectName}`,
     "",
@@ -40816,8 +40997,8 @@ function buildProjectInfoSyncPlan(targetRepo2, project2, projects, repoRoot2) {
   const targetBase = `https://github.com/${targetRepo2}`;
   const targetBranch = branchFor(targetRepo2, projects);
   const orgDocs = [
-    (0, import_node_fs33.existsSync)((0, import_node_path32.join)(repoRoot2, "architecture.md")) ? `- [Hub architecture](${targetBase}/blob/${targetBranch}/architecture.md)` : "",
-    (0, import_node_fs33.existsSync)((0, import_node_path32.join)(repoRoot2, "docs", "Architecture", "agentic-dev-environment.md")) ? `- [Agentic development environment](${targetBase}/blob/${targetBranch}/docs/Architecture/agentic-dev-environment.md)` : ""
+    (0, import_node_fs34.existsSync)((0, import_node_path33.join)(repoRoot2, "architecture.md")) ? `- [Hub architecture](${targetBase}/blob/${targetBranch}/architecture.md)` : "",
+    (0, import_node_fs34.existsSync)((0, import_node_path33.join)(repoRoot2, "docs", "Architecture", "agentic-dev-environment.md")) ? `- [Agentic development environment](${targetBase}/blob/${targetBranch}/docs/Architecture/agentic-dev-environment.md)` : ""
   ].filter(Boolean);
   if (orgDocs.length) lines2.push("", "## Organisation docs", "", ...orgDocs);
   return { projectId: project2.projectId, projectName, targetRepo: targetRepo2, memberRepos, shortDescription, readme: `${lines2.join("\n")}
@@ -40839,8 +41020,8 @@ async function syncProjectInfo(plan, client, apply) {
 }
 
 // src/train-commands.ts
-var import_node_fs34 = require("node:fs");
-var import_node_path33 = require("node:path");
+var import_node_fs35 = require("node:fs");
+var import_node_path34 = require("node:path");
 init_cli_shared();
 init_clean_exit();
 init_client_version();
@@ -40855,7 +41036,7 @@ function resolveReleaseBumpIntent(raw) {
 }
 function readRepoVersion() {
   try {
-    return JSON.parse((0, import_node_fs34.readFileSync)((0, import_node_path33.join)(process.cwd(), ".claude-plugin", "plugin.json"), "utf8")).version || void 0;
+    return JSON.parse((0, import_node_fs35.readFileSync)((0, import_node_path34.join)(process.cwd(), ".claude-plugin", "plugin.json"), "utf8")).version || void 0;
   } catch {
     return void 0;
   }
@@ -40966,7 +41147,7 @@ function releaseProgressVerdict(status, subject = "Release") {
 
 // src/suite-pin.ts
 var import_promises6 = require("node:fs/promises");
-var import_node_path34 = require("node:path");
+var import_node_path35 = require("node:path");
 var SuitePinError = class _SuitePinError extends Error {
   diagnostic;
   constructor(repo, tag, error) {
@@ -41034,8 +41215,8 @@ async function openSuiteCutPinPr(deps, input) {
       if (input.carriedOnly) return { status: "unchanged" };
       throw new Error("pins already match without a merged cut PR \u2014 provenance unverified");
     }
-    await (0, import_promises6.mkdir)((0, import_node_path34.join)(deps.root, "tmp"), { recursive: true });
-    scratch = await (0, import_promises6.mkdtemp)((0, import_node_path34.join)(deps.root, "tmp", "suite-pin-"));
+    await (0, import_promises6.mkdir)((0, import_node_path35.join)(deps.root, "tmp"), { recursive: true });
+    scratch = await (0, import_promises6.mkdtemp)((0, import_node_path35.join)(deps.root, "tmp", "suite-pin-"));
     const run = (file, args) => deps.run(file, args, scratch);
     await run("git", ["clone", "--quiet", "--branch", prs.length ? branch : "development", "--single-branch", `https://github.com/${SUITE_REPO}.git`, "."]);
     if (prs.length) {
@@ -41047,7 +41228,7 @@ async function openSuiteCutPinPr(deps, input) {
       await run("git", ["switch", "-c", branch]);
     }
     for (const stage of ["rc", "main"]) {
-      const path2 = (0, import_node_path34.join)(scratch, `${stage}-pins.json`);
+      const path2 = (0, import_node_path35.join)(scratch, `${stage}-pins.json`);
       await (0, import_promises6.writeFile)(path2, JSON.stringify(input.pins.map((p) => ({ module: p.module, url: p[stage] }))));
       await run("node", ["scripts/pin-modules.mjs", "--stage", stage, "--pins", path2]);
     }
@@ -41100,12 +41281,12 @@ async function openSuiteRestorePinPr(deps, input) {
       }
     });
     if (!todo.length) return void 0;
-    await (0, import_promises6.mkdir)((0, import_node_path34.join)(deps.root, "tmp"), { recursive: true });
-    scratch = await (0, import_promises6.mkdtemp)((0, import_node_path34.join)(deps.root, "tmp", "suite-pin-"));
+    await (0, import_promises6.mkdir)((0, import_node_path35.join)(deps.root, "tmp"), { recursive: true });
+    scratch = await (0, import_promises6.mkdtemp)((0, import_node_path35.join)(deps.root, "tmp", "suite-pin-"));
     const run = (file, args) => deps.run(file, args, scratch);
     await run("git", ["clone", "--quiet", "--branch", "development", "--single-branch", `https://github.com/${SUITE_REPO}.git`, "."]);
     await run("git", ["switch", "-c", branch]);
-    const path2 = (0, import_node_path34.join)(scratch, "main-pins.json");
+    const path2 = (0, import_node_path35.join)(scratch, "main-pins.json");
     await (0, import_promises6.writeFile)(path2, JSON.stringify(todo.map((p) => ({ module: p.module, url: p.prior }))));
     await run("node", ["scripts/pin-modules.mjs", "--stage", "main", "--pins", path2]);
     await run("git", ["add", "seed/modules.json"]);
@@ -41179,8 +41360,8 @@ async function openSuitePinPr(deps, input) {
     if (newer.length) return { status: "superseded", pr: newer[0].url, url: pin };
     const open2 = onBranch.find((p) => p.state === "OPEN");
     if (open2 && tagOf(open2.title ?? "") === tag) return { status: "pending", pr: open2.url, url: pin };
-    await (0, import_promises6.mkdir)((0, import_node_path34.join)(deps.root, "tmp"), { recursive: true });
-    scratch = await (0, import_promises6.mkdtemp)((0, import_node_path34.join)(deps.root, "tmp", "suite-pin-"));
+    await (0, import_promises6.mkdir)((0, import_node_path35.join)(deps.root, "tmp"), { recursive: true });
+    scratch = await (0, import_promises6.mkdtemp)((0, import_node_path35.join)(deps.root, "tmp", "suite-pin-"));
     const run = (file, args) => deps.run(file, args, scratch);
     await run("git", ["clone", "--quiet", "--branch", "development", "--single-branch", `https://github.com/${SUITE_REPO}.git`, "."]);
     await run("git", ["switch", "-c", branch]);
@@ -41220,7 +41401,7 @@ async function openSuitePinPr(deps, input) {
 
 // src/command-register-collaboration.ts
 var import_node_child_process17 = require("node:child_process");
-var import_node_fs43 = require("node:fs");
+var import_node_fs44 = require("node:fs");
 var import_promises8 = require("node:fs/promises");
 init_clean_exit();
 init_cli_shared();
@@ -41244,11 +41425,11 @@ function spawnDetachedSelf(args, deps, opts = {}) {
 }
 
 // src/command-register-collaboration.ts
-var import_node_path42 = require("node:path");
+var import_node_path43 = require("node:path");
 init_house_map();
 
 // src/issue-body.ts
-var import_node_os19 = require("node:os");
+var import_node_os20 = require("node:os");
 init_error_codes();
 var TextArgError = class extends Error {
   constructor(message2, code, offendingFlag) {
@@ -41261,7 +41442,7 @@ var TextArgError = class extends Error {
   offendingFlag;
 };
 function emptyStdinMessage(fileFlag) {
-  if ((0, import_node_os19.platform)() === "win32") {
+  if ((0, import_node_os20.platform)() === "win32") {
     return `${fileFlag} - read empty stdin (on Windows, ${fileFlag} - is unreliable through the npm .cmd shim \u2014 use ${fileFlag} <path>, or pipe to \`node cli/dist/index.cjs\` directly)`;
   }
   return `${fileFlag} - read empty stdin (nothing piped \u2014 pass a heredoc/pipe, or ${fileFlag} <path>)`;
@@ -41354,8 +41535,8 @@ init_github_client();
 init_github_quota();
 
 // src/issue-commands.ts
-var import_node_fs35 = require("node:fs");
-var import_node_crypto15 = require("node:crypto");
+var import_node_fs36 = require("node:fs");
+var import_node_crypto16 = require("node:crypto");
 init_cli_shared();
 init_clean_exit();
 init_error_codes();
@@ -41547,7 +41728,7 @@ async function editIssue(client, options, deps = {}) {
   const url = `https://github.com/${repo}/issues/${parsed.number}`;
   const patch = {};
   let bodyChanged = false;
-  const textDeps = () => deps.textDeps ?? { readFile: (p, e) => Promise.resolve((0, import_node_fs35.readFileSync)(p, e)), readStdin: () => Promise.resolve("") };
+  const textDeps = () => deps.textDeps ?? { readFile: (p, e) => Promise.resolve((0, import_node_fs36.readFileSync)(p, e)), readStdin: () => Promise.resolve("") };
   if (options.titleFile !== void 0) {
     patch.title = await resolveIssueTitle({ title: options.title, titleFile: options.titleFile }, textDeps());
   } else if (options.title !== void 0) {
@@ -41828,7 +42009,7 @@ function rowIdempotencyKey(batchKey, spec) {
   const identity = `${spec.type}
 ${spec.title.trim()}
 ${spec.body ?? ""}`;
-  const hash = (0, import_node_crypto15.createHash)("sha256").update(identity).digest("hex").slice(0, 16);
+  const hash = (0, import_node_crypto16.createHash)("sha256").update(identity).digest("hex").slice(0, 16);
   return `${batchKey}:${hash}`;
 }
 var BATCH_SPEC_KEYS = /* @__PURE__ */ new Set(["type", "title", "body", "priority", "labels", "label", "parent", "repo", "surface"]);
@@ -42210,7 +42391,7 @@ function extendCreateCommand(issue, batchAttach) {
     if (opts.batch) {
       let specs;
       try {
-        const raw = (0, import_node_fs35.readFileSync)(opts.batch, "utf8");
+        const raw = (0, import_node_fs36.readFileSync)(opts.batch, "utf8");
         specs = JSON.parse(raw);
         if (!Array.isArray(specs)) {
           const top = specs === null ? "null" : typeof specs === "object" ? `an object with keys: ${Object.keys(specs).join(", ") || "(none)"}` : `a ${typeof specs}`;
@@ -42287,8 +42468,8 @@ ${lines2}`, {
 }
 
 // src/post-merge-recon.ts
-var import_node_fs36 = require("node:fs");
-var import_node_path35 = require("node:path");
+var import_node_fs37 = require("node:fs");
+var import_node_path36 = require("node:path");
 
 // src/cross-repo-filing-issue.ts
 init_github_client();
@@ -42457,16 +42638,16 @@ function buildPostMergeReconRecovery(input) {
 }
 function writePostMergeReconRecovery(cwd, recovery) {
   const path2 = postMergeReconStatePath(cwd, recovery.repo, recovery.pr);
-  (0, import_node_fs36.mkdirSync)((0, import_node_path35.dirname)(path2), { recursive: true });
-  (0, import_node_fs36.writeFileSync)(path2, `${JSON.stringify(recovery, null, 2)}
+  (0, import_node_fs37.mkdirSync)((0, import_node_path36.dirname)(path2), { recursive: true });
+  (0, import_node_fs37.writeFileSync)(path2, `${JSON.stringify(recovery, null, 2)}
 `, "utf8");
   return path2;
 }
 function clearPostMergeReconRecovery(cwd, repo, pr) {
   const path2 = postMergeReconStatePath(cwd, repo, pr);
-  if (!(0, import_node_fs36.existsSync)(path2)) return;
+  if (!(0, import_node_fs37.existsSync)(path2)) return;
   try {
-    (0, import_node_fs36.unlinkSync)(path2);
+    (0, import_node_fs37.unlinkSync)(path2);
   } catch {
   }
 }
@@ -42942,9 +43123,9 @@ function registerPrLifecycleCommands(program3) {
 
 // src/review-verdict.ts
 var import_node_child_process14 = require("node:child_process");
-var import_node_fs37 = require("node:fs");
-var import_node_os20 = require("node:os");
-var import_node_path36 = require("node:path");
+var import_node_fs38 = require("node:fs");
+var import_node_os21 = require("node:os");
+var import_node_path37 = require("node:path");
 init_cli_shared();
 var REVIEW_VERDICT_MARKER = "<!-- zeroci-review v1 -->";
 var REVIEW_VERDICTS = ["PROCEED", "CORRECT", "ESCALATE"];
@@ -43109,15 +43290,15 @@ async function readPrIssueComments(number, repo) {
   return comments;
 }
 async function postPrCommentFromFile(number, repo, body) {
-  const dir = (0, import_node_fs37.mkdtempSync)((0, import_node_path36.join)((0, import_node_os20.tmpdir)(), "mmi-review-verdict-"));
-  const path2 = (0, import_node_path36.join)(dir, "body.md");
+  const dir = (0, import_node_fs38.mkdtempSync)((0, import_node_path37.join)((0, import_node_os21.tmpdir)(), "mmi-review-verdict-"));
+  const path2 = (0, import_node_path37.join)(dir, "body.md");
   try {
-    (0, import_node_fs37.writeFileSync)(path2, body, "utf8");
+    (0, import_node_fs38.writeFileSync)(path2, body, "utf8");
     const { stdout } = await execFileP("gh", ["pr", "comment", number, "--repo", repo, "--body-file", path2], { timeout: GH_MUTATION_TIMEOUT_MS });
     return stdout.trim();
   } finally {
     try {
-      (0, import_node_fs37.rmSync)(dir, { recursive: true, force: true });
+      (0, import_node_fs38.rmSync)(dir, { recursive: true, force: true });
     } catch {
     }
   }
@@ -43351,18 +43532,18 @@ async function prCreateClaimRefusal(body, repoOption, deps = {}) {
 }
 
 // src/worktree-residue-sweep.ts
-var import_node_fs42 = require("node:fs");
-var import_node_path41 = require("node:path");
+var import_node_fs43 = require("node:fs");
+var import_node_path42 = require("node:path");
 
 // src/worktree-merge-cleanup.ts
-var import_node_fs41 = require("node:fs");
-var import_node_path40 = require("node:path");
+var import_node_fs42 = require("node:fs");
+var import_node_path41 = require("node:path");
 init_cli_shared();
 
 // src/stage-runner.ts
 var import_node_child_process16 = require("node:child_process");
-var import_node_fs39 = require("node:fs");
-var import_node_path38 = require("node:path");
+var import_node_fs40 = require("node:fs");
+var import_node_path39 = require("node:path");
 var import_node_net = require("node:net");
 var import_node_util5 = require("node:util");
 
@@ -43372,8 +43553,8 @@ function normalizeEol2(s) {
 }
 
 // src/env-detection.ts
-var import_node_fs38 = require("node:fs");
-var import_node_path37 = require("node:path");
+var import_node_fs39 = require("node:fs");
+var import_node_path38 = require("node:path");
 var SKIPPED_DIRS = /* @__PURE__ */ new Set([".git", "node_modules", "dist", ".jerv", ".pi", ".venv", "venv"]);
 function isEnvBaseName(name) {
   return name.toLowerCase() === ".env";
@@ -43383,7 +43564,7 @@ function findEnvFiles(root) {
   const walk2 = (dir, rel) => {
     let entries;
     try {
-      entries = (0, import_node_fs38.readdirSync)(dir, { withFileTypes: true });
+      entries = (0, import_node_fs39.readdirSync)(dir, { withFileTypes: true });
     } catch {
       return;
     }
@@ -43391,13 +43572,13 @@ function findEnvFiles(root) {
       const relPath = rel ? `${rel}/${entry.name}` : entry.name;
       if (entry.isDirectory()) {
         if (SKIPPED_DIRS.has(entry.name)) continue;
-        walk2((0, import_node_path37.join)(dir, entry.name), relPath);
+        walk2((0, import_node_path38.join)(dir, entry.name), relPath);
         continue;
       }
       if (isEnvBaseName(entry.name)) {
         let isDir = false;
         try {
-          isDir = (0, import_node_fs38.lstatSync)((0, import_node_path37.join)(dir, entry.name)).isDirectory();
+          isDir = (0, import_node_fs39.lstatSync)((0, import_node_path38.join)(dir, entry.name)).isDirectory();
         } catch {
         }
         if (!isDir) found.push(relPath);
@@ -43536,12 +43717,12 @@ var DOCKER_TIMEOUT_MS = 15e3;
 function stageBash() {
   if (process.platform !== "win32") return "bash";
   const configured = process.env.SHELL;
-  if (configured && (0, import_node_path38.isAbsolute)(configured) && /[/\\]bash(?:\.exe)?$/i.test(configured) && !/[/\\](?:System32|Sysnative)[/\\]bash(?:\.exe)?$/i.test(configured) && (0, import_node_fs39.existsSync)(configured)) return configured;
+  if (configured && (0, import_node_path39.isAbsolute)(configured) && /[/\\]bash(?:\.exe)?$/i.test(configured) && !/[/\\](?:System32|Sysnative)[/\\]bash(?:\.exe)?$/i.test(configured) && (0, import_node_fs40.existsSync)(configured)) return configured;
   const candidates = [
-    (0, import_node_path38.join)(process.env.ProgramFiles || "C:\\Program Files", "Git", "bin", "bash.exe"),
-    ...process.env.LOCALAPPDATA ? [(0, import_node_path38.join)(process.env.LOCALAPPDATA, "Programs", "Git", "bin", "bash.exe")] : []
+    (0, import_node_path39.join)(process.env.ProgramFiles || "C:\\Program Files", "Git", "bin", "bash.exe"),
+    ...process.env.LOCALAPPDATA ? [(0, import_node_path39.join)(process.env.LOCALAPPDATA, "Programs", "Git", "bin", "bash.exe")] : []
   ];
-  const bash = candidates.find((path2) => (0, import_node_fs39.existsSync)(path2));
+  const bash = candidates.find((path2) => (0, import_node_fs40.existsSync)(path2));
   if (!bash) throw new Error("Local stages require Git Bash on Windows. Install Git for Windows or set SHELL to its absolute bash.exe path.");
   return bash;
 }
@@ -43679,7 +43860,7 @@ function appendForceRecreate(up) {
   return `${up.trimEnd()} --force-recreate`;
 }
 function stageStatePath(cwd = process.cwd()) {
-  return (0, import_node_path38.join)(cwd, "tmp", "stage", "state.json");
+  return (0, import_node_path39.join)(cwd, "tmp", "stage", "state.json");
 }
 function normPath(path2) {
   return path2.replace(/\\/g, "/").replace(/\/+$/, "").toLowerCase();
@@ -43896,8 +44077,8 @@ function stageProcessEnv(stagePort, extraEnv) {
 }
 function composeResolvesPort(cwd) {
   if (process.env.PORT) return true;
-  const envFile = (0, import_node_path38.join)(cwd, ".env");
-  return (0, import_node_fs39.existsSync)(envFile) && envFileKeys((0, import_node_fs39.readFileSync)(envFile, "utf8")).has("PORT");
+  const envFile = (0, import_node_path39.join)(cwd, ".env");
+  return (0, import_node_fs40.existsSync)(envFile) && envFileKeys((0, import_node_fs40.readFileSync)(envFile, "utf8")).has("PORT");
 }
 function stageComposeEnv(config, stagePort, vaultEnvMerge, cwd) {
   const composeProject = config.env?.COMPOSE_PROJECT_NAME ?? vaultEnvMerge?.COMPOSE_PROJECT_NAME ?? stageComposeProjectName(cwd);
@@ -43912,13 +44093,13 @@ function stageComposeEnv(config, stagePort, vaultEnvMerge, cwd) {
 function stageComposeFiles(cwd) {
   const files = ["docker-compose.yml"];
   for (const conventional of ["docker-compose.override.yml", "docker-compose.override.yaml"]) {
-    if ((0, import_node_fs39.existsSync)((0, import_node_path38.join)(cwd, conventional))) files.push(conventional);
+    if ((0, import_node_fs40.existsSync)((0, import_node_path39.join)(cwd, conventional))) files.push(conventional);
   }
   return [...files, RUNTIME_ENV_OVERRIDE_RELPATH];
 }
 async function prepareRuntimeEnvPassthrough(cwd, composeEnv, vaultEnvMerge) {
   const keys = Object.keys(vaultEnvMerge ?? {});
-  if (!keys.length || !(0, import_node_fs39.existsSync)((0, import_node_path38.join)(cwd, "docker-compose.yml"))) return {};
+  if (!keys.length || !(0, import_node_fs40.existsSync)((0, import_node_path39.join)(cwd, "docker-compose.yml"))) return {};
   let configJson;
   try {
     const { stdout } = await execFileP3("docker", ["compose", "config", "--format", "json"], {
@@ -43934,21 +44115,21 @@ async function prepareRuntimeEnvPassthrough(cwd, composeEnv, vaultEnvMerge) {
   }
   const body = renderRuntimeEnvOverride(runtimeEnvMarkedServices(configJson), keys, runtimeEnvExcludes(configJson), runtimeEnvSelects(configJson));
   if (!body) return {};
-  const overridePath = (0, import_node_path38.join)(cwd, RUNTIME_ENV_OVERRIDE_RELPATH);
-  (0, import_node_fs39.mkdirSync)((0, import_node_path38.join)(cwd, "tmp", "stage"), { recursive: true });
-  (0, import_node_fs39.writeFileSync)(overridePath, body, "utf8");
+  const overridePath = (0, import_node_path39.join)(cwd, RUNTIME_ENV_OVERRIDE_RELPATH);
+  (0, import_node_fs40.mkdirSync)((0, import_node_path39.join)(cwd, "tmp", "stage"), { recursive: true });
+  (0, import_node_fs40.writeFileSync)(overridePath, body, "utf8");
   return stageComposeFileEnv(stageComposeFiles(cwd));
 }
 async function ensureStageRuntimeEnv(config, opts, cwd) {
   if (!config.ensureEnv) return;
-  const target = (0, import_node_path38.join)(cwd, config.ensureEnv.target);
-  const example = (0, import_node_path38.join)(cwd, config.ensureEnv.example);
-  if (!(0, import_node_fs39.existsSync)(target) && (0, import_node_fs39.existsSync)(example)) {
-    (0, import_node_fs39.copyFileSync)(example, target);
-  } else if ((0, import_node_fs39.existsSync)(target) && (0, import_node_fs39.existsSync)(example)) {
-    const stale = detectStaleEnvFile((0, import_node_fs39.readFileSync)(example, "utf8"), (0, import_node_fs39.readFileSync)(target, "utf8"), {
-      exampleMtimeMs: (0, import_node_fs39.statSync)(example).mtimeMs,
-      targetMtimeMs: (0, import_node_fs39.statSync)(target).mtimeMs
+  const target = (0, import_node_path39.join)(cwd, config.ensureEnv.target);
+  const example = (0, import_node_path39.join)(cwd, config.ensureEnv.example);
+  if (!(0, import_node_fs40.existsSync)(target) && (0, import_node_fs40.existsSync)(example)) {
+    (0, import_node_fs40.copyFileSync)(example, target);
+  } else if ((0, import_node_fs40.existsSync)(target) && (0, import_node_fs40.existsSync)(example)) {
+    const stale = detectStaleEnvFile((0, import_node_fs40.readFileSync)(example, "utf8"), (0, import_node_fs40.readFileSync)(target, "utf8"), {
+      exampleMtimeMs: (0, import_node_fs40.statSync)(example).mtimeMs,
+      targetMtimeMs: (0, import_node_fs40.statSync)(target).mtimeMs
     });
     if (stale) {
       const msg = `stale ${config.ensureEnv.target} (${stale}) \u2014 delete it or refresh from ${config.ensureEnv.example} before re-running /stage`;
@@ -43956,8 +44137,8 @@ async function ensureStageRuntimeEnv(config, opts, cwd) {
       console.error(`mmi-cli stage: ${msg} (allowed via --allow-stale-env)`);
     }
   }
-  if (opts.vaultEnvMerge && Object.keys(opts.vaultEnvMerge).length && (0, import_node_fs39.existsSync)(target)) {
-    (0, import_node_fs39.writeFileSync)(target, mergeEnvSecretsIntoFile((0, import_node_fs39.readFileSync)(target, "utf8"), opts.vaultEnvMerge), "utf8");
+  if (opts.vaultEnvMerge && Object.keys(opts.vaultEnvMerge).length && (0, import_node_fs40.existsSync)(target)) {
+    (0, import_node_fs40.writeFileSync)(target, mergeEnvSecretsIntoFile((0, import_node_fs40.readFileSync)(target, "utf8"), opts.vaultEnvMerge), "utf8");
   }
 }
 async function gitText(cwd, args) {
@@ -43987,20 +44168,20 @@ async function resolveGlobalStatePath(cwd, explicit) {
   return void 0;
 }
 function readState(path2) {
-  if (!(0, import_node_fs39.existsSync)(path2)) return null;
+  if (!(0, import_node_fs40.existsSync)(path2)) return null;
   try {
-    return JSON.parse((0, import_node_fs39.readFileSync)(path2, "utf8"));
+    return JSON.parse((0, import_node_fs40.readFileSync)(path2, "utf8"));
   } catch {
     return null;
   }
 }
 function mkdirFor(path2) {
   const dir = path2.slice(0, Math.max(path2.lastIndexOf("/"), path2.lastIndexOf("\\")));
-  (0, import_node_fs39.mkdirSync)(dir, { recursive: true });
+  (0, import_node_fs40.mkdirSync)(dir, { recursive: true });
 }
 function writeState(path2, state) {
   mkdirFor(path2);
-  (0, import_node_fs39.writeFileSync)(path2, JSON.stringify(state, null, 2), "utf8");
+  (0, import_node_fs40.writeFileSync)(path2, JSON.stringify(state, null, 2), "utf8");
 }
 function writeStagePortReservation(port, cwd, statePath, globalStatePath, now) {
   const reservation = {
@@ -44029,7 +44210,7 @@ async function cleanupStageState(state, paths, timeoutMs, fallbackCwd, currentEn
     );
   }
   for (const path2 of [...new Set(paths.filter((p) => Boolean(p)))]) {
-    (0, import_node_fs39.rmSync)(path2, { force: true });
+    (0, import_node_fs40.rmSync)(path2, { force: true });
   }
 }
 async function killTree(pid) {
@@ -44276,8 +44457,8 @@ async function runStage(config = {}, opts = {}) {
       });
     }
   } catch (e) {
-    (0, import_node_fs39.rmSync)(statePath, { force: true });
-    if (globalStatePath && globalStatePath !== statePath) (0, import_node_fs39.rmSync)(globalStatePath, { force: true });
+    (0, import_node_fs40.rmSync)(statePath, { force: true });
+    if (globalStatePath && globalStatePath !== statePath) (0, import_node_fs40.rmSync)(globalStatePath, { force: true });
     throw e;
   }
   const started = await startStage(config, {
@@ -44292,8 +44473,8 @@ async function runStage(config = {}, opts = {}) {
 }
 
 // src/worktree-evidence-archive.ts
-var import_node_fs40 = require("node:fs");
-var import_node_path39 = require("node:path");
+var import_node_fs41 = require("node:fs");
+var import_node_path40 = require("node:path");
 var JERV_ARTIFACT_RUN_SCOPE_ENV_VARS = ["JERV_RUN_ID", ...SESSION_ID_ENV_VARS];
 function sanitizeArchiveSegment(value, max = 80) {
   const scrubbed = value.replace(/[^A-Za-z0-9._@+-]+/g, "-").replace(/^-+|-+$/g, "");
@@ -44308,24 +44489,24 @@ function resolveArtifactRunScope(env = process.env) {
 }
 function defaultIsDirectory(path2) {
   try {
-    return (0, import_node_fs40.lstatSync)(path2).isDirectory();
+    return (0, import_node_fs41.lstatSync)(path2).isDirectory();
   } catch {
     return false;
   }
 }
 function archiveWorktreeJervArtifacts(args, deps = {}) {
-  const exists = deps.exists ?? import_node_fs40.existsSync;
+  const exists = deps.exists ?? import_node_fs41.existsSync;
   const isDirectory = deps.isDirectory ?? defaultIsDirectory;
-  const copyDir = deps.copyDir ?? ((from, to) => (0, import_node_fs40.cpSync)(from, to, { recursive: true, force: true }));
+  const copyDir = deps.copyDir ?? ((from, to) => (0, import_node_fs41.cpSync)(from, to, { recursive: true, force: true }));
   const mkdirp = deps.mkdirp ?? ((path2) => {
-    (0, import_node_fs40.mkdirSync)(path2, { recursive: true });
+    (0, import_node_fs41.mkdirSync)(path2, { recursive: true });
   });
   const env = deps.env ?? process.env;
   const now = deps.now ?? (() => /* @__PURE__ */ new Date());
   const resolveRoot = deps.resolveArchiveRoot ?? repoRuntimeStatePath;
   if (!args.primaryRoot?.trim()) return { status: "skipped", reason: "missing-primary-root" };
   if (!args.worktreePath?.trim()) return { status: "skipped", reason: "missing-worktree-path" };
-  const source = (0, import_node_path39.join)(args.worktreePath, ".jerv");
+  const source = (0, import_node_path40.join)(args.worktreePath, ".jerv");
   if (!exists(source)) return { status: "absent" };
   if (!isDirectory(source)) return { status: "skipped", reason: "jerv-not-a-directory" };
   const runScope = resolveArtifactRunScope(env);
@@ -44333,7 +44514,7 @@ function archiveWorktreeJervArtifacts(args, deps = {}) {
   const stamp = now().toISOString().replace(/[:.]/g, "-");
   const dest = resolveRoot(args.primaryRoot, "jerv-artifacts", runScope, branchSlug, stamp, ".jerv");
   try {
-    mkdirp((0, import_node_path39.dirname)(dest));
+    mkdirp((0, import_node_path40.dirname)(dest));
     copyDir(source, dest);
     if (!exists(dest)) return { status: "failed", error: `archive write left no directory at ${dest}` };
     return { status: "archived", path: dest, runScope };
@@ -44342,14 +44523,14 @@ function archiveWorktreeJervArtifacts(args, deps = {}) {
   }
 }
 function defaultStat(path2) {
-  const st = (0, import_node_fs40.statSync)(path2);
+  const st = (0, import_node_fs41.statSync)(path2);
   return { mtimeMs: st.mtimeMs, size: st.size, isDirectory: () => st.isDirectory() };
 }
 function scanWorktreeTmpEvidence(worktreePath, newerThanMs, deps = {}) {
-  const exists = deps.exists ?? import_node_fs40.existsSync;
+  const exists = deps.exists ?? import_node_fs41.existsSync;
   const stat4 = deps.stat ?? defaultStat;
-  const readdir2 = deps.readdir ?? import_node_fs40.readdirSync;
-  const tmpRoot = (0, import_node_path39.join)(worktreePath, "tmp");
+  const readdir2 = deps.readdir ?? import_node_fs41.readdirSync;
+  const tmpRoot = (0, import_node_path40.join)(worktreePath, "tmp");
   if (!exists(tmpRoot)) return [];
   const entries = [];
   const walk2 = (dir) => {
@@ -44360,14 +44541,14 @@ function scanWorktreeTmpEvidence(worktreePath, newerThanMs, deps = {}) {
       return;
     }
     for (const name of names) {
-      const full = (0, import_node_path39.join)(dir, name);
+      const full = (0, import_node_path40.join)(dir, name);
       let st;
       try {
         st = stat4(full);
       } catch {
         continue;
       }
-      const relPath = (0, import_node_path39.relative)(worktreePath, full).replace(/\\/g, "/");
+      const relPath = (0, import_node_path40.relative)(worktreePath, full).replace(/\\/g, "/");
       if (st.isDirectory()) {
         if (st.mtimeMs > newerThanMs) entries.push({ relPath, bytes: 0, mtimeMs: st.mtimeMs });
         walk2(full);
@@ -44381,10 +44562,10 @@ function scanWorktreeTmpEvidence(worktreePath, newerThanMs, deps = {}) {
   return entries;
 }
 function archiveWorktreeTmpArtifacts(args, deps = {}) {
-  const exists = deps.exists ?? import_node_fs40.existsSync;
-  const copyDir = deps.copyDir ?? ((from, to) => (0, import_node_fs40.cpSync)(from, to, { recursive: true, force: true }));
+  const exists = deps.exists ?? import_node_fs41.existsSync;
+  const copyDir = deps.copyDir ?? ((from, to) => (0, import_node_fs41.cpSync)(from, to, { recursive: true, force: true }));
   const mkdirp = deps.mkdirp ?? ((path2) => {
-    (0, import_node_fs40.mkdirSync)(path2, { recursive: true });
+    (0, import_node_fs41.mkdirSync)(path2, { recursive: true });
   });
   const env = deps.env ?? process.env;
   const now = deps.now ?? (() => /* @__PURE__ */ new Date());
@@ -44392,7 +44573,7 @@ function archiveWorktreeTmpArtifacts(args, deps = {}) {
   if (!args.primaryRoot?.trim()) return { status: "skipped", reason: "missing-primary-root" };
   if (!args.worktreePath?.trim()) return { status: "skipped", reason: "missing-worktree-path" };
   const scanned = scanWorktreeTmpEvidence(args.worktreePath, args.newerThanMs, deps);
-  const source = (0, import_node_path39.join)(args.worktreePath, "tmp");
+  const source = (0, import_node_path40.join)(args.worktreePath, "tmp");
   if (!scanned.length) return { status: "absent" };
   if (!exists(source)) return { status: "absent" };
   const runScope = resolveArtifactRunScope(env);
@@ -44400,7 +44581,7 @@ function archiveWorktreeTmpArtifacts(args, deps = {}) {
   const stamp = now().toISOString().replace(/[:.]/g, "-");
   const dest = resolveRoot(args.primaryRoot, "worktree-artifacts", runScope, branchSlug, stamp, "tmp");
   try {
-    mkdirp((0, import_node_path39.dirname)(dest));
+    mkdirp((0, import_node_path40.dirname)(dest));
     copyDir(source, dest);
     if (!exists(dest)) return { status: "failed", error: `archive write left no directory at ${dest}` };
     const bytes = scanned.reduce((sum, e) => sum + e.bytes, 0);
@@ -44469,9 +44650,9 @@ function normPath2(p) {
   return p.replace(/\\/g, "/").replace(/\/+$/, "");
 }
 function unlinkNodeModulesJunction(wtPath) {
-  const nm = (0, import_node_path40.join)(wtPath, "node_modules");
+  const nm = (0, import_node_path41.join)(wtPath, "node_modules");
   try {
-    if ((0, import_node_fs41.lstatSync)(nm).isSymbolicLink()) (0, import_node_fs41.rmdirSync)(nm);
+    if ((0, import_node_fs42.lstatSync)(nm).isSymbolicLink()) (0, import_node_fs42.rmdirSync)(nm);
     return { ok: true };
   } catch (e) {
     if (e.code === "ENOENT") return { ok: true };
@@ -44482,8 +44663,8 @@ function defaultSleep2(ms) {
   return new Promise((resolve7) => setTimeout(resolve7, ms));
 }
 async function removeResidueDirectory(wtPath, options = {}) {
-  const { sleep: sleep2 = defaultSleep2, removeEmptyDir = import_node_fs41.rmdirSync, exists = import_node_fs41.existsSync } = options;
-  const removeRecursive = options.removeRecursive ?? ((path2) => (0, import_node_fs41.rmSync)(path2, { recursive: true, force: true, maxRetries: 10, retryDelay: 100 }));
+  const { sleep: sleep2 = defaultSleep2, removeEmptyDir = import_node_fs42.rmdirSync, exists = import_node_fs42.existsSync } = options;
+  const removeRecursive = options.removeRecursive ?? ((path2) => (0, import_node_fs42.rmSync)(path2, { recursive: true, force: true, maxRetries: 10, retryDelay: 100 }));
   const junction = unlinkNodeModulesJunction(wtPath);
   if (!junction.ok) return junction;
   try {
@@ -44606,28 +44787,28 @@ async function preCleanWorktreeForRemoval(wtPath, execGit) {
 }
 async function listNestedIgnoredNodeModules(wtPath, execGit) {
   const out = await execGit(["-C", wtPath, "ls-files", "--others", "--ignored", "--exclude-standard", "--directory"]).catch(() => "");
-  return out.split(/\r?\n/).map((line) => line.trim()).filter((line) => line.endsWith("node_modules/") && line !== "node_modules/").map((line) => (0, import_node_path40.join)(wtPath, line.slice(0, -1)));
+  return out.split(/\r?\n/).map((line) => line.trim()).filter((line) => line.endsWith("node_modules/") && line !== "node_modules/").map((line) => (0, import_node_path41.join)(wtPath, line.slice(0, -1)));
 }
 function safeRemoveTree(path2) {
-  const stat4 = (0, import_node_fs41.lstatSync)(path2);
+  const stat4 = (0, import_node_fs42.lstatSync)(path2);
   if (stat4.isSymbolicLink()) {
     try {
-      (0, import_node_fs41.rmdirSync)(path2);
+      (0, import_node_fs42.rmdirSync)(path2);
     } catch {
-      (0, import_node_fs41.unlinkSync)(path2);
+      (0, import_node_fs42.unlinkSync)(path2);
     }
     return;
   }
   if (stat4.isDirectory()) {
-    for (const entry of (0, import_node_fs41.readdirSync)(path2)) safeRemoveTree((0, import_node_path40.join)(path2, entry));
-    (0, import_node_fs41.rmdirSync)(path2);
+    for (const entry of (0, import_node_fs42.readdirSync)(path2)) safeRemoveTree((0, import_node_path41.join)(path2, entry));
+    (0, import_node_fs42.rmdirSync)(path2);
     return;
   }
-  (0, import_node_fs41.unlinkSync)(path2);
+  (0, import_node_fs42.unlinkSync)(path2);
 }
 async function removeWorktreeNodeModules(wtPath) {
   try {
-    safeRemoveTree((0, import_node_path40.join)(wtPath, "node_modules"));
+    safeRemoveTree((0, import_node_path41.join)(wtPath, "node_modules"));
     return { ok: true };
   } catch (e) {
     if (e.code === "ENOENT") return { ok: true };
@@ -44639,7 +44820,7 @@ function errorMessage(e) {
 }
 function resolvedOrRaw(path2) {
   try {
-    return normPath2((0, import_node_fs41.realpathSync)(path2));
+    return normPath2((0, import_node_fs42.realpathSync)(path2));
   } catch {
     return normPath2(path2);
   }
@@ -44647,10 +44828,10 @@ function resolvedOrRaw(path2) {
 function unlinkEscapingReparsePoints(root, primaryRoot) {
   let realRoot;
   try {
-    if ((0, import_node_fs41.lstatSync)(root).isSymbolicLink()) {
+    if ((0, import_node_fs42.lstatSync)(root).isSymbolicLink()) {
       return { ok: false, error: `delete root ${normPath2(root)} is a reparse point resolving to ${resolvedOrRaw(root)}` };
     }
-    realRoot = normPath2((0, import_node_fs41.realpathSync)(root));
+    realRoot = normPath2((0, import_node_fs42.realpathSync)(root));
   } catch (e) {
     if (e.code === "ENOENT") return { ok: true, unlinked: [] };
     return { ok: false, error: `cannot resolve delete root ${normPath2(root)}: ${errorMessage(e)}` };
@@ -44666,17 +44847,17 @@ function unlinkEscapingReparsePoints(root, primaryRoot) {
     const dir = stack.pop();
     let entries;
     try {
-      entries = (0, import_node_fs41.readdirSync)(dir, { withFileTypes: true });
+      entries = (0, import_node_fs42.readdirSync)(dir, { withFileTypes: true });
     } catch (e) {
       if (e.code === "ENOENT") continue;
       return { ok: false, error: `cannot scan ${normPath2(dir)} for reparse points: ${errorMessage(e)}` };
     }
     for (const entry of entries) {
-      const child2 = (0, import_node_path40.join)(dir, entry.name);
+      const child2 = (0, import_node_path41.join)(dir, entry.name);
       if (entry.isSymbolicLink()) {
         let target = "";
         try {
-          target = normPath2((0, import_node_fs41.realpathSync)(child2));
+          target = normPath2((0, import_node_fs42.realpathSync)(child2));
         } catch {
           target = "";
         }
@@ -44859,7 +45040,7 @@ async function cleanupPrMergeLocalBranch(branch, options) {
     return report;
   }
   const execGit = options.execGit ?? (async (args) => (await execFileP("git", args, { timeout: GIT_TIMEOUT_MS })).stdout);
-  const pathExists = options.pathExists ?? import_node_fs41.existsSync;
+  const pathExists = options.pathExists ?? import_node_fs42.existsSync;
   let afterWorktrees = [];
   try {
     afterWorktrees = parseGitWorktreePorcelain(await execGit(["worktree", "list", "--porcelain"]));
@@ -44999,7 +45180,7 @@ async function cleanupPrMergeLocalBranch(branch, options) {
   const preHelperGuard = unlinkEscapingReparsePoints(wtPath, options.primaryRoot);
   if (!preHelperGuard.ok) return refuseReparseEscape(preHelperGuard.error);
   unlinkedReparsePoints.push(...preHelperGuard.unlinked);
-  if (pathExists((0, import_node_path40.join)(wtPath, "node_modules"))) {
+  if (pathExists((0, import_node_path41.join)(wtPath, "node_modules"))) {
     const nmRemoved = await (options.removeRealNodeModules ?? removeWorktreeNodeModules)(wtPath);
     if (!nmRemoved.ok) {
       report.worktree = {
@@ -45135,18 +45316,18 @@ function renderPrMergeCleanupLines(cleanup) {
 // src/worktree-residue-sweep.ts
 var RESIDUE_LEDGER_FILE = "mmi-worktree-residue.json";
 function canonicalWorktreeRoot(primary) {
-  return (0, import_node_path41.join)((0, import_node_path41.dirname)(primary), "mmi-worktrees", (0, import_node_path41.basename)(primary));
+  return (0, import_node_path42.join)((0, import_node_path42.dirname)(primary), "mmi-worktrees", (0, import_node_path42.basename)(primary));
 }
 function norm(p) {
   const s = p.replace(/\\/g, "/").replace(/\/+$/, "");
   return process.platform === "win32" ? s.toLowerCase() : s;
 }
 function residueLedgerPath(gitCommonDir) {
-  return (0, import_node_path41.join)(gitCommonDir, RESIDUE_LEDGER_FILE);
+  return (0, import_node_path42.join)(gitCommonDir, RESIDUE_LEDGER_FILE);
 }
 function readPaths(file, deps) {
   try {
-    const parsed = JSON.parse((deps.readLedger ?? ((f) => (0, import_node_fs42.readFileSync)(f, "utf8")))(file));
+    const parsed = JSON.parse((deps.readLedger ?? ((f) => (0, import_node_fs43.readFileSync)(f, "utf8")))(file));
     return Array.isArray(parsed) ? parsed.filter((p) => typeof p === "string") : [];
   } catch {
     return [];
@@ -45155,8 +45336,8 @@ function readPaths(file, deps) {
 function writePaths(file, paths, deps) {
   try {
     const write = deps.writeLedger ?? ((f, t) => {
-      (0, import_node_fs42.mkdirSync)((0, import_node_path41.dirname)(f), { recursive: true });
-      (0, import_node_fs42.writeFileSync)(f, t, "utf8");
+      (0, import_node_fs43.mkdirSync)((0, import_node_path42.dirname)(f), { recursive: true });
+      (0, import_node_fs43.writeFileSync)(f, t, "utf8");
     });
     write(file, `${JSON.stringify([...new Set(paths)], null, 1)}
 `);
@@ -45170,17 +45351,17 @@ function recordResidue(gitCommonDir, path2, deps = {}) {
   writePaths(file, paths, deps);
 }
 async function sweepWorktreeResidue(gitCommonDir, registered, deps = {}) {
-  const exists = deps.exists ?? import_node_fs42.existsSync;
-  const readDir = deps.readDir ?? ((p) => (0, import_node_fs42.readdirSync)(p));
+  const exists = deps.exists ?? import_node_fs43.existsSync;
+  const readDir = deps.readDir ?? ((p) => (0, import_node_fs43.readdirSync)(p));
   const isDir = deps.isDir ?? ((p) => {
     try {
-      return (0, import_node_fs42.statSync)(p).isDirectory();
+      return (0, import_node_fs43.statSync)(p).isDirectory();
     } catch {
       return false;
     }
   });
   const removeRecorded = deps.removeRecorded ?? ((p) => removeResidueDirectory(p));
-  const removeEmpty = deps.removeEmpty ?? ((p) => (0, import_node_fs42.rmdirSync)(p));
+  const removeEmpty = deps.removeEmpty ?? ((p) => (0, import_node_fs43.rmdirSync)(p));
   const report = { swept: [], kept: [], dropped: [], emptyRemoved: [], unrecorded: [] };
   const live = new Set(registered.map(norm));
   const primary = registered[0] ? norm(registered[0]) : void 0;
@@ -45215,7 +45396,7 @@ async function sweepWorktreeResidue(gitCommonDir, registered, deps = {}) {
     } catch {
     }
     for (const name of children) {
-      const child2 = (0, import_node_path41.join)(root, name);
+      const child2 = (0, import_node_path42.join)(root, name);
       const key = norm(child2);
       if (live.has(key) || key === primary || keptKeys.has(key) || !isDir(child2)) continue;
       let entries;
@@ -45258,10 +45439,10 @@ function argvWantsJson2() {
   return process.argv.some((a) => a === "--json" || a.startsWith("--json="));
 }
 function hubRoot() {
-  const fromPkg = (0, import_node_path42.join)(__dirname, "..", "..");
+  const fromPkg = (0, import_node_path43.join)(__dirname, "..", "..");
   const marker = "skills/bootstrap/seeds/manifest.json";
-  if ((0, import_node_fs43.existsSync)((0, import_node_path42.join)(fromPkg, marker))) return fromPkg;
-  if ((0, import_node_fs43.existsSync)((0, import_node_path42.join)(process.cwd(), marker))) return process.cwd();
+  if ((0, import_node_fs44.existsSync)((0, import_node_path43.join)(fromPkg, marker))) return fromPkg;
+  if ((0, import_node_fs44.existsSync)((0, import_node_path43.join)(process.cwd(), marker))) return process.cwd();
   return null;
 }
 function ciAuditDeps() {
@@ -45273,8 +45454,8 @@ function ciAuditDeps() {
     getProjectMeta: async (slug) => fetchProjectBySlug(slug, registryClientDeps(await cfgPromise)),
     readSeedFile: (path2) => {
       if (!root) return null;
-      const fullPath = (0, import_node_path42.join)(root, path2);
-      return (0, import_node_fs43.existsSync)(fullPath) ? (0, import_node_fs43.readFileSync)(fullPath, "utf8") : null;
+      const fullPath = (0, import_node_path43.join)(root, path2);
+      return (0, import_node_fs44.existsSync)(fullPath) ? (0, import_node_fs44.readFileSync)(fullPath, "utf8") : null;
     }
   };
 }
@@ -46037,11 +46218,11 @@ ${list}`);
     }
   });
   async function listCiWorkflowPaths(cwd = process.cwd()) {
-    const wfDir = (0, import_node_path42.join)(cwd, ".github", "workflows");
-    if (!(0, import_node_fs43.existsSync)(wfDir)) return [];
-    return (0, import_node_fs43.readdirSync)(wfDir).filter((name) => /\.(ya?ml)$/i.test(name)).filter((name) => {
+    const wfDir = (0, import_node_path43.join)(cwd, ".github", "workflows");
+    if (!(0, import_node_fs44.existsSync)(wfDir)) return [];
+    return (0, import_node_fs44.readdirSync)(wfDir).filter((name) => /\.(ya?ml)$/i.test(name)).filter((name) => {
       try {
-        return workflowReportsPrChecks((0, import_node_fs43.readFileSync)((0, import_node_path42.join)(wfDir, name), "utf8"));
+        return workflowReportsPrChecks((0, import_node_fs44.readFileSync)((0, import_node_path43.join)(wfDir, name), "utf8"));
       } catch {
         return true;
       }
@@ -46246,7 +46427,7 @@ ${list}`);
   jsonParity(pr.command("review-verdict <number>").description("post an explicit review verdict comment: computes the PR diff patch-id and head sha, renders the v1 contract body, and posts it as a PR comment").requiredOption("--repo <owner/repo>", "target repo").requiredOption("--verdict <verdict>", `one of ${REVIEW_VERDICTS.join("|")}`).requiredOption("--scope <text>", "one line: what was reviewed").requiredOption("--risk <text>", "one line: the residual risk").option("--unverified <text>", "a claim the reviewer could not verify (repeatable)", (v, acc) => [...acc, v], []).requiredOption("--reviewer <id>", "reviewer seat or model id").option("--findings-file <path>", "Markdown findings appended after the JSON block")).action(async (number, o) => {
     if (!isReviewVerdict(o.verdict)) return fail(`pr review-verdict: --verdict must be one of ${REVIEW_VERDICTS.join("|")} (got ${o.verdict})`);
     const verdict = o.verdict;
-    const findings = o.findingsFile ? (0, import_node_fs43.readFileSync)(o.findingsFile, "utf8") : void 0;
+    const findings = o.findingsFile ? (0, import_node_fs44.readFileSync)(o.findingsFile, "utf8") : void 0;
     let patch;
     let head;
     try {
@@ -46523,7 +46704,7 @@ ${list}`);
     const mergeSquashBody = squashBodyTextForMerge(
       closingGuardInput,
       method === "--squash",
-      o.squashBodyFile ? (0, import_node_fs43.readFileSync)(o.squashBodyFile, "utf8") : void 0
+      o.squashBodyFile ? (0, import_node_fs44.readFileSync)(o.squashBodyFile, "utf8") : void 0
     );
     if (!o.squashBodyFile) warnSquashBodyClosingStrip("pr merge", closingGuardInput, mergeSquashBody);
     const closingGuardVerdict = evaluateClosingGuard(closingGuardInput, {
@@ -46555,7 +46736,7 @@ ${list}`);
     const remote = foreignCwd ? `https://github.com/${targetRepo2}.git` : "origin";
     let foreignCheckout;
     if (foreignCwd) {
-      const sibling = (0, import_node_path42.join)((0, import_node_path42.dirname)(beforeWorktrees[0]?.path || startingPath || process.cwd()), targetRepo2.split("/")[1]);
+      const sibling = (0, import_node_path43.join)((0, import_node_path43.dirname)(beforeWorktrees[0]?.path || startingPath || process.cwd()), targetRepo2.split("/")[1]);
       const siblingRepo = repoFromRemoteUrl(await gitOut(["-C", sibling, "remote", "get-url", "origin"]).catch(() => ""));
       if (siblingRepo?.toLowerCase() === targetRepo2.toLowerCase()) {
         const siblingWorktrees = await execFileP("git", ["-C", sibling, "worktree", "list", "--porcelain"], { timeout: GIT_TIMEOUT_MS }).then((r) => parseGitWorktreePorcelain(r.stdout)).catch(() => void 0);
@@ -46653,7 +46834,7 @@ ${list}`);
         }
         if (!repoForPostCleanup) throw e;
         console.warn(`pr merge: gh GraphQL rate-limited \u2014 merging PR #${number} via REST PUT instead (#4588).`);
-        const commitMessage = bodyFile ? (0, import_node_fs43.readFileSync)(bodyFile, "utf8") : void 0;
+        const commitMessage = bodyFile ? (0, import_node_fs44.readFileSync)(bodyFile, "utf8") : void 0;
         await defaultGitHubClient().rest("PUT", `repos/${repoForPostCleanup}/pulls/${number}/merge`, {
           body: { merge_method: method.slice(2), ...commitMessage ? { commit_message: commitMessage } : {} },
           timeoutMs: GH_MUTATION_TIMEOUT_MS
@@ -46767,7 +46948,7 @@ ${list}`);
     let residueSweep;
     if (!(foreignCwd && !foreignCheckout)) {
       try {
-        gitCommonDir = (0, import_node_path42.resolve)(primaryRoot, (await execFileP("git", ["-C", primaryRoot, "rev-parse", "--git-common-dir"], { timeout: GIT_TIMEOUT_MS })).stdout.trim());
+        gitCommonDir = (0, import_node_path43.resolve)(primaryRoot, (await execFileP("git", ["-C", primaryRoot, "rev-parse", "--git-common-dir"], { timeout: GIT_TIMEOUT_MS })).stdout.trim());
         residueSweep = await sweepWorktreeResidue(gitCommonDir, beforeWorktrees.map((w) => w.path));
       } catch {
       }
@@ -46785,7 +46966,7 @@ ${list}`);
           preserveWorktree: o.preserveWorktree,
           gcAcknowledged: o.gc,
           expectedHeadOid: headRefOid,
-          pathExists: (p) => (0, import_node_fs43.existsSync)(p),
+          pathExists: (p) => (0, import_node_fs44.existsSync)(p),
           // #5899: pin cleanup git calls to the main checkout — the task worktree this process may be
           // standing in is removed mid-cleanup, so a cwd-relative invocation fails with
           // 'fatal: not a git repository' and leaves a spurious partial-cleanup exit.
@@ -48017,18 +48198,18 @@ function rcRunCauseFromLog(log) {
 function memberAnnounceSummaryFile(repo, summaryFile, memberSummaryFiles) {
   return repo === SUITE_REPO ? summaryFile : memberSummaryFiles[repo];
 }
-var suiteStateDir = (root) => (0, import_node_path43.join)(resolvePrimaryGitDir(root), "mmi-runtime", "suite");
+var suiteStateDir = (root) => (0, import_node_path44.join)(resolvePrimaryGitDir(root), "mmi-runtime", "suite");
 function suiteTrainIo(root, summaryFile, memberSummaryFiles = {}, summaryFileTr, memberSummaryFilesTr = {}) {
-  const recordPath = (0, import_node_path43.join)(suiteStateDir(root), "cut.json");
-  const base = (0, import_node_path43.join)(suiteStateDir(root), "checkouts");
+  const recordPath = (0, import_node_path44.join)(suiteStateDir(root), "cut.json");
+  const base = (0, import_node_path44.join)(suiteStateDir(root), "checkouts");
   const checkout = async (repo) => {
     if (repo === SUITE_REPO) return root;
-    const target = (0, import_node_path43.join)(base, repo.split("/")[1]);
-    if (!(0, import_node_fs44.existsSync)(target)) {
-      (0, import_node_fs44.mkdirSync)(base, { recursive: true });
+    const target = (0, import_node_path44.join)(base, repo.split("/")[1]);
+    if (!(0, import_node_fs45.existsSync)(target)) {
+      (0, import_node_fs45.mkdirSync)(base, { recursive: true });
       await exec("git", ["clone", "--quiet", "--branch", "development", `https://github.com/${repo}.git`, target], root, WATCH_TIMEOUT);
     }
-    if (!(0, import_node_fs44.existsSync)((0, import_node_path43.join)(target, ".git"))) throw new Error(`${repo}: suite checkout has no .git at ${target}; stop`);
+    if (!(0, import_node_fs45.existsSync)((0, import_node_path44.join)(target, ".git"))) throw new Error(`${repo}: suite checkout has no .git at ${target}; stop`);
     const origin = await exec("git", ["remote", "get-url", "origin"], target);
     if (!origin.toLowerCase().endsWith(`/${repo.toLowerCase()}.git`) && !origin.toLowerCase().endsWith(`/${repo.toLowerCase()}`))
       throw new Error(`${repo}: suite checkout origin mismatch at ${target}; stop`);
@@ -48351,9 +48532,9 @@ function suiteTrainIo(root, summaryFile, memberSummaryFiles = {}, summaryFileTr,
       const body = await gh(["release", "view", leadTag, "--repo", SUITE_REPO, "--json", "body", "--jq", ".body"]);
       if (parseSuiteMapping(body)) return;
       const dir = suiteStateDir(root);
-      (0, import_node_fs44.mkdirSync)(dir, { recursive: true });
-      const file = (0, import_node_path43.join)(dir, `notes-${leadTag}.md`);
-      (0, import_node_fs44.writeFileSync)(file, `${body}
+      (0, import_node_fs45.mkdirSync)(dir, { recursive: true });
+      const file = (0, import_node_path44.join)(dir, `notes-${leadTag}.md`);
+      (0, import_node_fs45.writeFileSync)(file, `${body}
 
 ${suiteMappingBlock(leadTag, mapping)}`);
       await gh(["release", "edit", leadTag, "--repo", SUITE_REPO, "--notes-file", file]);
@@ -48394,7 +48575,7 @@ ${suiteMappingBlock(leadTag, mapping)}`);
 
 // src/suite-commands.ts
 init_cli_shared();
-var import_node_fs45 = require("node:fs");
+var import_node_fs46 = require("node:fs");
 function parseMemberSummaryFiles(entries) {
   const memberSummaryFiles = {};
   for (const entry of entries) {
@@ -48476,7 +48657,7 @@ function registerSuiteCommands(program3) {
       try {
         const io = suiteTrainIo(root);
         retired = await retireFailedLeadRcLedger({ ledgerPath: releaseLedgerPath(root), rcHead: () => io.head(SUITE_REPO, "rc").then((h) => h ?? void 0), markAbandoned: io.markAbandoned }, o.ownerGo === true);
-        if (retired && !(0, import_node_fs45.existsSync)(io.recordPath)) {
+        if (retired && !(0, import_node_fs46.existsSync)(io.recordPath)) {
           console.log(o.json ? JSON.stringify({ retiredLeadRc: retired }, null, 2) : `suite abandon: retired the lead's failed, never-promoted rc candidate ${retired}; marked abandoned on origin (#7854)`);
           return;
         }
@@ -48665,9 +48846,9 @@ function suiteStatusDeps(github, registry2) {
 
 // src/packages-adopt-export.ts
 var import_node_child_process18 = require("node:child_process");
-var import_node_fs46 = require("node:fs");
-var import_node_os21 = require("node:os");
-var import_node_path44 = require("node:path");
+var import_node_fs47 = require("node:fs");
+var import_node_os22 = require("node:os");
+var import_node_path45 = require("node:path");
 var import_node_util6 = require("node:util");
 init_cli_shared();
 
@@ -49287,38 +49468,38 @@ function expectedFromRun(run, opts) {
 }
 async function adoptExport(opts, deps) {
   if (!/^sha256:[0-9a-f]{64}$/.test(opts.digest)) throw new Error("--digest must be sha256:<64 hex>, from the export run summary");
-  const packagePath = (0, import_node_path44.join)(opts.dir, "package.json");
-  const lockPath = (0, import_node_path44.join)(opts.dir, "package-lock.json");
-  const packageText = (0, import_node_fs46.readFileSync)(packagePath, "utf8");
-  const lockText = (0, import_node_fs46.readFileSync)(lockPath, "utf8");
-  const work = (0, import_node_fs46.mkdtempSync)((0, import_node_path44.join)((0, import_node_os21.tmpdir)(), "mmi-adopt-export-"));
+  const packagePath = (0, import_node_path45.join)(opts.dir, "package.json");
+  const lockPath = (0, import_node_path45.join)(opts.dir, "package-lock.json");
+  const packageText = (0, import_node_fs47.readFileSync)(packagePath, "utf8");
+  const lockText = (0, import_node_fs47.readFileSync)(lockPath, "utf8");
+  const work = (0, import_node_fs47.mkdtempSync)((0, import_node_path45.join)((0, import_node_os22.tmpdir)(), "mmi-adopt-export-"));
   try {
     const run = JSON.parse((await deps.ghApi(`repos/${EXPORT_REPO}/actions/runs/${opts.run}`)).toString("utf8"));
-    (0, import_node_fs46.writeFileSync)((0, import_node_path44.join)(work, "expected.json"), JSON.stringify(expectedFromRun(run, opts)));
-    (0, import_node_fs46.writeFileSync)((0, import_node_path44.join)(work, "provider.json"), await deps.ghApi(`repos/${EXPORT_REPO}/actions/artifacts/${opts.artifact}`));
-    (0, import_node_fs46.writeFileSync)((0, import_node_path44.join)(work, "artifact.zip"), await deps.ghApi(`repos/${EXPORT_REPO}/actions/artifacts/${opts.artifact}/zip`));
-    const script = (0, import_node_path44.join)(work, "package_export.py");
-    (0, import_node_fs46.writeFileSync)(script, package_export_default);
+    (0, import_node_fs47.writeFileSync)((0, import_node_path45.join)(work, "expected.json"), JSON.stringify(expectedFromRun(run, opts)));
+    (0, import_node_fs47.writeFileSync)((0, import_node_path45.join)(work, "provider.json"), await deps.ghApi(`repos/${EXPORT_REPO}/actions/artifacts/${opts.artifact}`));
+    (0, import_node_fs47.writeFileSync)((0, import_node_path45.join)(work, "artifact.zip"), await deps.ghApi(`repos/${EXPORT_REPO}/actions/artifacts/${opts.artifact}/zip`));
+    const script = (0, import_node_path45.join)(work, "package_export.py");
+    (0, import_node_fs47.writeFileSync)(script, package_export_default);
     await deps.python(script, ["verify", work, opts.ds, opts.screens]);
-    const verified = (0, import_node_path44.join)(work, "verified");
-    const metadata = Object.fromEntries(PACKAGES.map(({ name, short: short3 }) => [name, JSON.parse((0, import_node_fs46.readFileSync)((0, import_node_path44.join)(verified, `${short3}.metadata.json`), "utf8"))]));
+    const verified = (0, import_node_path45.join)(work, "verified");
+    const metadata = Object.fromEntries(PACKAGES.map(({ name, short: short3 }) => [name, JSON.parse((0, import_node_fs47.readFileSync)((0, import_node_path45.join)(verified, `${short3}.metadata.json`), "utf8"))]));
     const plan = planAdoption(packageText, lockText, metadata);
     for (const { name } of plan.result.adopted) {
       const short3 = PACKAGES.find((p) => p.name === name).short;
-      await deps.npm(["cache", "add", (0, import_node_path44.join)(verified, `${short3}.tgz`)], opts.dir);
+      await deps.npm(["cache", "add", (0, import_node_path45.join)(verified, `${short3}.tgz`)], opts.dir);
     }
-    (0, import_node_fs46.writeFileSync)(packagePath, plan.packageText);
-    (0, import_node_fs46.writeFileSync)(lockPath, plan.lockText);
+    (0, import_node_fs47.writeFileSync)(packagePath, plan.packageText);
+    (0, import_node_fs47.writeFileSync)(lockPath, plan.lockText);
     try {
       await deps.npm(["ci", "--offline", "--ignore-scripts", "--no-audit", "--no-fund"], opts.dir);
     } catch (error) {
-      (0, import_node_fs46.writeFileSync)(packagePath, packageText);
-      (0, import_node_fs46.writeFileSync)(lockPath, lockText);
+      (0, import_node_fs47.writeFileSync)(packagePath, packageText);
+      (0, import_node_fs47.writeFileSync)(lockPath, lockText);
       throw new Error(`npm ci --offline failed, package.json and package-lock.json restored: ${error.message}`);
     }
     return plan.result;
   } finally {
-    (0, import_node_fs46.rmSync)(work, { recursive: true, force: true });
+    (0, import_node_fs47.rmSync)(work, { recursive: true, force: true });
   }
 }
 var execFileBuffer = (0, import_node_util6.promisify)(import_node_child_process18.execFile);
@@ -49383,12 +49564,12 @@ function registerPackagesCommands(program3) {
 init_cli_shared();
 
 // src/wave-status.ts
-var import_node_fs47 = require("node:fs");
+var import_node_fs48 = require("node:fs");
 function readStageSummary(worktreePath) {
   const statePath = stageStatePath(worktreePath);
-  if (!(0, import_node_fs47.existsSync)(statePath)) return void 0;
+  if (!(0, import_node_fs48.existsSync)(statePath)) return void 0;
   try {
-    const state = JSON.parse((0, import_node_fs47.readFileSync)(statePath, "utf8"));
+    const state = JSON.parse((0, import_node_fs48.readFileSync)(statePath, "utf8"));
     const port = typeof state.port === "number" ? state.port : void 0;
     if (port == null || !Number.isInteger(port) || port <= 0) return void 0;
     return { port, url: typeof state.url === "string" ? state.url : void 0 };
@@ -49445,9 +49626,9 @@ async function collectWaveStatus(deps) {
 // src/discovery-commands.ts
 init_github_client();
 init_cli_shared();
-var import_node_fs48 = require("node:fs");
-var import_node_os22 = require("node:os");
-var import_node_path45 = require("node:path");
+var import_node_fs49 = require("node:fs");
+var import_node_os23 = require("node:os");
+var import_node_path46 = require("node:path");
 var GC_GH_TIMEOUT_MS3 = 2e4;
 async function collectStatus() {
   const repo = await resolveRepo();
@@ -49636,10 +49817,10 @@ async function collectOnboardStatus(opts = {}) {
     else if (top) nextCommand = `mmi-cli oracle board claim ${top.number}  # ${top.title}`;
     else nextCommand = "mmi-cli oracle board read \u2014 no claimable items found";
   }
-  const home = (0, import_node_os22.homedir)();
+  const home = (0, import_node_os23.homedir)();
   const plugin = onboardPluginGate({
-    readKnown: () => readFileSyncSafe((0, import_node_path45.join)(home, ...KNOWN_MARKETPLACES_RELATIVE), import_node_fs48.readFileSync),
-    readSettings: () => readFileSyncSafe((0, import_node_path45.join)(home, ".claude", "settings.json"), import_node_fs48.readFileSync)
+    readKnown: () => readFileSyncSafe((0, import_node_path46.join)(home, ...KNOWN_MARKETPLACES_RELATIVE), import_node_fs49.readFileSync),
+    readSettings: () => readFileSyncSafe((0, import_node_path46.join)(home, ".claude", "settings.json"), import_node_fs49.readFileSync)
   });
   return {
     guide: "Read the MMI org-guide skill before project work; load only the relevant topic. Use mmi-help for a short introduction.",
@@ -51831,6 +52012,9 @@ function registerOrgHealthQuery(program3, deps = defaultOrgHealthQueryDeps()) {
   });
 }
 
+// src/api-read.ts
+var import_node_fs50 = require("node:fs");
+
 // src/app-read-broker.ts
 init_cli_shared();
 var OWNER_REPO_RE = /^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/;
@@ -52200,7 +52384,10 @@ var CONTENTS_QUERY_RE = /^ref=[^&\s]+$/;
 var ACTIONS_RUNS_RE = new RegExp(`^repos/${NAME}/${NAME}/actions/runs$`);
 var ACTIONS_RUN_RE = new RegExp(`^repos/${NAME}/${NAME}/actions/runs/\\d+$`);
 var ACTIONS_JOBS_RE = new RegExp(`^repos/${NAME}/${NAME}/actions/runs/\\d+/jobs$`);
-var API_GET_ALLOWED_SHAPES = "repos/{owner}/{repo}/pulls/{n}/files, repos/{owner}/{repo}/compare/{a}...{b}, repos/{owner}/{repo}/contents/{path}[?ref=<branch>], repos/{owner}/{repo}/actions/runs, repos/{owner}/{repo}/actions/runs/{id}, repos/{owner}/{repo}/actions/runs/{id}/jobs";
+var ACTIONS_ARTIFACTS_RE = new RegExp(`^repos/${NAME}/${NAME}/actions/runs/\\d+/artifacts$`);
+var ACTIONS_ARTIFACT_ZIP_RE = new RegExp(`^repos/${NAME}/${NAME}/actions/artifacts/\\d+/zip$`);
+var ACTIONS_JOB_LOGS_RE = new RegExp(`^repos/${NAME}/${NAME}/actions/jobs/\\d+/logs$`);
+var API_GET_ALLOWED_SHAPES = "repos/{owner}/{repo}/pulls/{n}/files, repos/{owner}/{repo}/compare/{a}...{b}, repos/{owner}/{repo}/contents/{path}[?ref=<branch>], repos/{owner}/{repo}/actions/runs, repos/{owner}/{repo}/actions/runs/{id}, repos/{owner}/{repo}/actions/runs/{id}/jobs, repos/{owner}/{repo}/actions/runs/{id}/artifacts, repos/{owner}/{repo}/actions/artifacts/{id}/zip (needs --out <file>), repos/{owner}/{repo}/actions/jobs/{id}/logs (needs --out <file>)";
 function parseApiGetPath(rawPath) {
   const path2 = rawPath.trim();
   const refuse = () => new Error(`api get: refusing '${rawPath}' \u2014 only these GET reads are allowed (#7219): ${API_GET_ALLOWED_SHAPES}`);
@@ -52210,6 +52397,9 @@ function parseApiGetPath(rawPath) {
   if (ACTIONS_RUNS_RE.test(path2)) return { kind: "actions-runs", path: path2, paginate: true };
   if (ACTIONS_RUN_RE.test(path2)) return { kind: "actions-run", path: path2, paginate: false };
   if (ACTIONS_JOBS_RE.test(path2)) return { kind: "actions-jobs", path: path2, paginate: true };
+  if (ACTIONS_ARTIFACTS_RE.test(path2)) return { kind: "actions-artifacts", path: path2, paginate: true };
+  if (ACTIONS_ARTIFACT_ZIP_RE.test(path2)) return { kind: "actions-artifact-zip", path: path2, paginate: false };
+  if (ACTIONS_JOB_LOGS_RE.test(path2)) return { kind: "actions-job-logs", path: path2, paginate: false };
   const q = path2.indexOf("?");
   const base = q === -1 ? path2 : path2.slice(0, q);
   const query = q === -1 ? "" : path2.slice(q + 1);
@@ -52218,6 +52408,8 @@ function parseApiGetPath(rawPath) {
   }
   throw new Error(`api get: refusing '${rawPath}' \u2014 only these GET reads are allowed (#7219): ${API_GET_ALLOWED_SHAPES}`);
 }
+var ZIP_TIMEOUT_MS = 12e4;
+var ZIP_MAX_BUFFER = 512 * 1024 * 1024;
 function buildApiGetArgs(path2, accept) {
   const req = parseApiGetPath(path2);
   const args = ["api", req.path];
@@ -52230,22 +52422,28 @@ async function runApiGet(run, path2, accept) {
   return run(buildApiGetArgs(path2, accept), GIT_TIMEOUT_MS);
 }
 function registerApiReadCommands(program3, overrides) {
-  const spawn6 = overrides?.runner ?? (async (args, timeoutMs, env) => (await execFileP("gh", args, { timeout: timeoutMs, ...env ? { env } : {} })).stdout);
-  const api = program3.command("api").description("bounded GitHub REST reads for automation \u2014 GET only, allowlisted paths (pull files, compare, contents, actions runs/jobs)");
+  const spawn6 = overrides?.runner ?? (async (args, timeoutMs, env, binary) => (await execFileP("gh", args, { timeout: timeoutMs, ...binary ? { encoding: "latin1", maxBuffer: ZIP_MAX_BUFFER } : {}, ...env ? { env } : {} })).stdout);
+  const api = program3.command("api").description("bounded GitHub REST reads for automation \u2014 GET only, allowlisted paths (pull files, compare, contents, actions runs/jobs/artifacts)");
   api.command("get").description("GET one allowlisted REST path and print the response body to stdout (JSON, or raw file bytes with --accept raw); refuses everything outside the allowlist").option("--accept <type>", "response media type: json (default) or raw (file bytes)", (v) => {
     acceptHeaderFor(v);
     return v.trim().toLowerCase();
-  }, "json").argument("<path>", "allowlisted GET path (shapes named on refusal)", (v) => parseApiGetPath(v)).action(async (req, o) => {
+  }, "json").option("--out <file>", "write the response bytes to this file instead of stdout (required for, and only valid with, actions/artifacts/{id}/zip)").argument("<path>", "allowlisted GET path (shapes named on refusal)", (v) => parseApiGetPath(v)).action(async (req, o) => {
+    const zip = req.kind === "actions-artifact-zip" || req.kind === "actions-job-logs";
+    if (zip !== (o.out !== void 0)) return fail(`api get: --out <file> is required for, and only valid with, repos/{owner}/{repo}/actions/artifacts/{id}/zip and repos/{owner}/{repo}/actions/jobs/{id}/logs`);
     const actionsRoute = req.kind.startsWith("actions-");
     if (actionsRoute) requireBrokerApp("api get");
     const env = actionsRoute || process.env.MMI_ACTOR === "app" ? brokerChildEnv() : void 0;
     let body;
     try {
       body = await runApiGet(
-        async (args, timeoutMs) => spawn6(args, timeoutMs, env),
+        async (args, timeoutMs) => zip ? spawn6(args, ZIP_TIMEOUT_MS, env, true) : spawn6(args, timeoutMs, env),
         req.path,
         o.accept
       );
+      if (zip) {
+        (0, import_node_fs50.writeFileSync)(o.out, body, "latin1");
+        return;
+      }
     } catch (e) {
       const err = e;
       return fail(`api get: ${(err.stderr || err.message || String(e)).trim()}`);
@@ -53102,8 +53300,8 @@ function registerSessionReport(program3) {
 }
 
 // src/stage-commands.ts
-var import_node_fs49 = require("node:fs");
-var import_node_path46 = require("node:path");
+var import_node_fs51 = require("node:fs");
+var import_node_path47 = require("node:path");
 init_cli_shared();
 init_clean_exit();
 
@@ -53351,8 +53549,8 @@ function registerStageCommands(program3) {
     const repo = Array.isArray(project2?.repos) && typeof project2.repos[0] === "string" ? project2.repos[0] : slug;
     const resolution = decideStage({
       registry: { deployModel: project2?.deployModel, portRange, error: read.ok ? void 0 : read.error },
-      hasCompose: (0, import_node_fs49.existsSync)((0, import_node_path46.join)(process.cwd(), "docker-compose.yml")),
-      hasEnvExample: (0, import_node_fs49.existsSync)((0, import_node_path46.join)(process.cwd(), ".env.example")),
+      hasCompose: (0, import_node_fs51.existsSync)((0, import_node_path47.join)(process.cwd(), "docker-compose.yml")),
+      hasEnvExample: (0, import_node_fs51.existsSync)((0, import_node_path47.join)(process.cwd(), ".env.example")),
       repo
     });
     if (resolution.source === "derived" && resolution.derived) {
@@ -53644,23 +53842,23 @@ vercel preview (${preview.branch}): ${d.state}${d.url ? ` \u2014 ${d.url}` : ""}
 }
 
 // src/tenant-artifact.ts
-var import_node_crypto16 = require("node:crypto");
-var import_node_fs50 = require("node:fs");
+var import_node_crypto17 = require("node:crypto");
+var import_node_fs52 = require("node:fs");
 var import_promises11 = require("node:fs/promises");
-var import_node_path47 = require("node:path");
+var import_node_path48 = require("node:path");
 var ARTIFACT_ID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;
-var MAX_BYTES = 5 * 1024 * 1024 * 1024;
+var MAX_BYTES2 = 5 * 1024 * 1024 * 1024;
 async function sha256File(path2) {
-  const hash = (0, import_node_crypto16.createHash)("sha256");
-  for await (const chunk of (0, import_node_fs50.createReadStream)(path2)) hash.update(chunk);
+  const hash = (0, import_node_crypto17.createHash)("sha256");
+  for await (const chunk of (0, import_node_fs52.createReadStream)(path2)) hash.update(chunk);
   return hash.digest("hex");
 }
 async function putTenantArtifact(repo, stage, inputPath, deps) {
   if (!["dev", "rc", "main"].includes(stage)) throw new Error("tenant artifact put: <stage> must be dev, rc, or main");
-  const path2 = (0, import_node_path47.resolve)(inputPath);
+  const path2 = (0, import_node_path48.resolve)(inputPath);
   const info = await (0, import_promises11.stat)(path2);
   if (!info.isFile()) throw new Error("tenant artifact put: input path must be a file");
-  if (!Number.isSafeInteger(info.size) || info.size < 1 || info.size > MAX_BYTES) throw new Error(`tenant artifact put: file must be 1..${MAX_BYTES} bytes`);
+  if (!Number.isSafeInteger(info.size) || info.size < 1 || info.size > MAX_BYTES2) throw new Error(`tenant artifact put: file must be 1..${MAX_BYTES2} bytes`);
   const sha2563 = await sha256File(path2);
   const prepared = await tenantArtifactUpload({ repo, stage, size: info.size, sha256: sha2563 }, deps);
   if (!prepared.ok) {
@@ -53675,7 +53873,7 @@ async function putTenantArtifact(repo, stage, inputPath, deps) {
     return [key, value];
   }));
   headers["content-length"] = String(info.size);
-  const stream = (0, import_node_fs50.createReadStream)(path2);
+  const stream = (0, import_node_fs52.createReadStream)(path2);
   let uploaded;
   try {
     uploaded = await fetch(body.uploadUrl, {
@@ -53814,7 +54012,7 @@ function renderVerifySecrets(body) {
 }
 
 // src/command-register-developer.ts
-var import_node_fs54 = require("node:fs");
+var import_node_fs56 = require("node:fs");
 init_clean_exit();
 init_cli_shared();
 init_error_codes();
@@ -53847,7 +54045,7 @@ async function resolveWhoami(deps) {
 }
 
 // src/command-register-developer.ts
-var import_node_path52 = require("node:path");
+var import_node_path53 = require("node:path");
 init_house_map();
 init_hub_url();
 
@@ -53881,28 +54079,28 @@ async function executeWaveLand(plan, deps) {
 
 // src/dist-drift.ts
 var import_node_child_process19 = require("node:child_process");
-var import_node_crypto18 = require("node:crypto");
-var import_node_fs52 = require("node:fs");
-var import_node_os23 = require("node:os");
-var import_node_path49 = require("node:path");
+var import_node_crypto19 = require("node:crypto");
+var import_node_fs54 = require("node:fs");
+var import_node_os24 = require("node:os");
+var import_node_path50 = require("node:path");
 
 // ../scripts/distribution-digest.mjs
-var import_node_crypto17 = require("node:crypto");
-var import_node_fs51 = require("node:fs");
-var import_node_path48 = require("node:path");
+var import_node_crypto18 = require("node:crypto");
+var import_node_fs53 = require("node:fs");
+var import_node_path49 = require("node:path");
 var slash = (value) => value.replaceAll("\\", "/");
 function repoPath(root, declaredPath, label) {
-  const absoluteRoot = (0, import_node_path48.resolve)(root);
-  const target = (0, import_node_path48.resolve)(root, declaredPath);
-  if (target !== absoluteRoot && !target.startsWith(`${absoluteRoot}${import_node_path48.sep}`)) {
+  const absoluteRoot = (0, import_node_path49.resolve)(root);
+  const target = (0, import_node_path49.resolve)(root, declaredPath);
+  if (target !== absoluteRoot && !target.startsWith(`${absoluteRoot}${import_node_path49.sep}`)) {
     throw new Error(`${label} ${declaredPath} escapes the repository root`);
   }
   return target;
 }
 function digestFiles(files) {
-  const hash = (0, import_node_crypto17.createHash)("sha256");
+  const hash = (0, import_node_crypto18.createHash)("sha256");
   for (const file of [...files].sort((a, b) => a.relative.localeCompare(b.relative))) {
-    const content = file.stat.isSymbolicLink() ? Buffer.from((0, import_node_fs51.readlinkSync)(file.absolute), "utf8") : (0, import_node_fs51.readFileSync)(file.absolute);
+    const content = file.stat.isSymbolicLink() ? Buffer.from((0, import_node_fs53.readlinkSync)(file.absolute), "utf8") : (0, import_node_fs53.readFileSync)(file.absolute);
     hash.update(file.relative, "utf8");
     hash.update("\0");
     hash.update(file.stat.isSymbolicLink() ? "symlink" : "file", "utf8");
@@ -53917,8 +54115,8 @@ function digestFiles(files) {
 function digestPackedFiles(packageRoot, packedFiles) {
   return digestFiles(packedFiles.map((path2) => {
     const absolute = repoPath(packageRoot, path2, "packed artifact identity path");
-    if (!(0, import_node_fs51.existsSync)(absolute)) throw new Error(`packed artifact identity path ${path2} does not exist`);
-    return { absolute, relative: slash(path2), stat: (0, import_node_fs51.lstatSync)(absolute) };
+    if (!(0, import_node_fs53.existsSync)(absolute)) throw new Error(`packed artifact identity path ${path2} does not exist`);
+    return { absolute, relative: slash(path2), stat: (0, import_node_fs53.lstatSync)(absolute) };
   }));
 }
 
@@ -53930,7 +54128,7 @@ var DIST_ARTIFACTS = [
 ];
 var BOM_DIST_TREE_ID = "mmi-cli-dist";
 var ABSENT = "absent";
-var sha2562 = (bytes) => `sha256:${(0, import_node_crypto18.createHash)("sha256").update(bytes).digest("hex")}`;
+var sha2562 = (bytes) => `sha256:${(0, import_node_crypto19.createHash)("sha256").update(bytes).digest("hex")}`;
 function artifactDrift(path2, committedBytes, rebuiltBytes) {
   const committed = committedBytes ? sha2562(committedBytes) : ABSENT;
   const rebuiltExpected = rebuiltBytes ? sha2562(rebuiltBytes) : ABSENT;
@@ -54002,13 +54200,13 @@ function renderDistDriftReceipt(receipt) {
   return lines2;
 }
 function readOrNull(path2) {
-  return (0, import_node_fs52.existsSync)(path2) ? (0, import_node_fs52.readFileSync)(path2) : null;
+  return (0, import_node_fs54.existsSync)(path2) ? (0, import_node_fs54.readFileSync)(path2) : null;
 }
 function walkFiles(root) {
   const files = [];
   const walk2 = (directory) => {
-    for (const entry of (0, import_node_fs52.readdirSync)(directory, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name))) {
-      const child2 = (0, import_node_path49.join)(directory, entry.name);
+    for (const entry of (0, import_node_fs54.readdirSync)(directory, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name))) {
+      const child2 = (0, import_node_path50.join)(directory, entry.name);
       if (entry.isDirectory()) walk2(child2);
       else files.push(child2);
     }
@@ -54018,10 +54216,10 @@ function walkFiles(root) {
 }
 function bomPathFor(root) {
   try {
-    const registry2 = JSON.parse((0, import_node_fs52.readFileSync)((0, import_node_path49.join)(root, "surfaces.json"), "utf8"));
-    return (0, import_node_path49.join)(root, registry2?.sharedAgentCore?.releaseMetadata?.bomPath ?? "distribution-bom.json");
+    const registry2 = JSON.parse((0, import_node_fs54.readFileSync)((0, import_node_path50.join)(root, "surfaces.json"), "utf8"));
+    return (0, import_node_path50.join)(root, registry2?.sharedAgentCore?.releaseMetadata?.bomPath ?? "distribution-bom.json");
   } catch {
-    return (0, import_node_path49.join)(root, "distribution-bom.json");
+    return (0, import_node_path50.join)(root, "distribution-bom.json");
   }
 }
 function rebuildTo(packageRoot, outDir) {
@@ -54034,35 +54232,35 @@ function rebuildTo(packageRoot, outDir) {
   });
 }
 function runDistStatus(root) {
-  const stage = (0, import_node_fs52.mkdtempSync)((0, import_node_path49.join)((0, import_node_os23.tmpdir)(), "mmi-dist-drift-"));
+  const stage = (0, import_node_fs54.mkdtempSync)((0, import_node_path50.join)((0, import_node_os24.tmpdir)(), "mmi-dist-drift-"));
   let overlayCount = 0;
   try {
-    const cliOut = (0, import_node_path49.join)(stage, "cli-dist");
-    const hubOut = (0, import_node_path49.join)(stage, "hub-dist");
-    rebuildTo((0, import_node_path49.join)(root, "cli"), cliOut);
-    rebuildTo((0, import_node_path49.join)(root, "updater"), hubOut);
+    const cliOut = (0, import_node_path50.join)(stage, "cli-dist");
+    const hubOut = (0, import_node_path50.join)(stage, "hub-dist");
+    rebuildTo((0, import_node_path50.join)(root, "cli"), cliOut);
+    rebuildTo((0, import_node_path50.join)(root, "updater"), hubOut);
     const outDirFor = (packageDir) => packageDir === "cli" ? cliOut : hubOut;
     const rebuilt = (path2) => {
       const spec = DIST_ARTIFACTS.find((entry) => entry.path === path2);
-      return spec ? readOrNull((0, import_node_path49.join)(outDirFor(spec.packageDir), spec.output)) : null;
+      return spec ? readOrNull((0, import_node_path50.join)(outDirFor(spec.packageDir), spec.output)) : null;
     };
-    const committed = (path2) => readOrNull((0, import_node_path49.join)(root, path2));
-    const tree = (path2) => readOrNull((0, import_node_path49.join)(root, path2));
-    const distRoot = (0, import_node_path49.join)(root, "cli", "dist");
-    const distTree = () => walkFiles(distRoot).map((absolute) => `cli/dist/${(0, import_node_path49.relative)(distRoot, absolute).replaceAll("\\", "/")}`);
-    const bom = JSON.parse((0, import_node_fs52.readFileSync)(bomPathFor(root), "utf8"));
+    const committed = (path2) => readOrNull((0, import_node_path50.join)(root, path2));
+    const tree = (path2) => readOrNull((0, import_node_path50.join)(root, path2));
+    const distRoot = (0, import_node_path50.join)(root, "cli", "dist");
+    const distTree = () => walkFiles(distRoot).map((absolute) => `cli/dist/${(0, import_node_path50.relative)(distRoot, absolute).replaceAll("\\", "/")}`);
+    const bom = JSON.parse((0, import_node_fs54.readFileSync)(bomPathFor(root), "utf8"));
     const digest = (entries) => {
-      const overlay = (0, import_node_path49.join)(stage, `overlay-${overlayCount++}`);
+      const overlay = (0, import_node_path50.join)(stage, `overlay-${overlayCount++}`);
       for (const entry of entries) {
-        const target = (0, import_node_path49.join)(overlay, entry.path);
-        (0, import_node_fs52.mkdirSync)((0, import_node_path49.dirname)(target), { recursive: true });
-        (0, import_node_fs52.writeFileSync)(target, entry.bytes);
+        const target = (0, import_node_path50.join)(overlay, entry.path);
+        (0, import_node_fs54.mkdirSync)((0, import_node_path50.dirname)(target), { recursive: true });
+        (0, import_node_fs54.writeFileSync)(target, entry.bytes);
       }
       return digestPackedFiles(overlay, entries.map((entry) => entry.path));
     };
     return computeDistDriftReceipt({ committed, tree, rebuilt, distTree, bom, digest });
   } finally {
-    (0, import_node_fs52.rmSync)(stage, { recursive: true, force: true });
+    (0, import_node_fs54.rmSync)(stage, { recursive: true, force: true });
   }
 }
 
@@ -54163,7 +54361,7 @@ init_hub_auth();
 
 // src/schedules-lift-command.ts
 var import_promises12 = require("node:fs/promises");
-var import_node_path50 = require("node:path");
+var import_node_path51 = require("node:path");
 init_clean_exit();
 init_cli_shared();
 var DEFAULT_WORKFLOWS_DIR = ".github/workflows";
@@ -54192,7 +54390,7 @@ async function readWorkflowFiles(dir) {
   const files = [];
   for (const name of names.sort()) {
     if (!/\.ya?ml$/.test(name)) continue;
-    files.push({ path: `.github/workflows/${name}`, text: await (0, import_promises12.readFile)((0, import_node_path50.join)(dir, name), "utf8") });
+    files.push({ path: `.github/workflows/${name}`, text: await (0, import_promises12.readFile)((0, import_node_path51.join)(dir, name), "utf8") });
   }
   return files;
 }
@@ -54275,8 +54473,8 @@ function registerSchedulesLiftCommand(program3, deps = {}) {
 
 // src/spawn-policy-core.ts
 var import_node_child_process20 = require("node:child_process");
-var import_node_fs53 = require("node:fs");
-var import_node_path51 = require("node:path");
+var import_node_fs55 = require("node:fs");
+var import_node_path52 = require("node:path");
 var SPAWNERS = ["spawn", "spawnSync", "exec", "execSync", "execFile", "execFileSync"];
 var CALL_SOURCE = String.raw`(^|[^.\w$])(${SPAWNERS.join("|")})\s*\(`;
 var SOURCE_EXT = /\.(ts|mts|cts|js|mjs|cjs)$/;
@@ -54362,7 +54560,7 @@ function runSpawnPolicy(root) {
   for (const file of files) {
     let raw;
     try {
-      raw = (0, import_node_fs53.readFileSync)((0, import_node_path51.join)(root, file), "utf8");
+      raw = (0, import_node_fs55.readFileSync)((0, import_node_path52.join)(root, file), "utf8");
     } catch {
       continue;
     }
@@ -54382,19 +54580,19 @@ function runSpawnPolicy(root) {
 function registerDeveloperCommands(program3) {
   const rules = program3.command("rules").description("org-managed .gitignore delivery");
   rules.command("gitignore").option("--write", "upsert the managed block into .gitignore (default: check only, non-zero exit on drift)").option("--json", "machine-readable output").description("verify (or --write) this repo's org-managed .gitignore block matches the SSOT").action((opts) => {
-    const path2 = (0, import_node_path52.join)(process.cwd(), ".gitignore");
-    const current = (0, import_node_fs54.existsSync)(path2) ? (0, import_node_fs54.readFileSync)(path2, "utf8") : null;
+    const path2 = (0, import_node_path53.join)(process.cwd(), ".gitignore");
+    const current = (0, import_node_fs56.existsSync)(path2) ? (0, import_node_fs56.readFileSync)(path2, "utf8") : null;
     const plan = planManagedGitignore(current);
     const drift = [...plan.added.map((l) => `+${l}`), ...plan.removed.map((l) => `-${l}`)].join(", ") || "block normalize";
     if (opts.json) {
-      if (opts.write && plan.changed) (0, import_node_fs54.writeFileSync)(path2, plan.content, "utf8");
+      if (opts.write && plan.changed) (0, import_node_fs56.writeFileSync)(path2, plan.content, "utf8");
       console.log(JSON.stringify(plan, null, 2));
       if (!opts.write && plan.changed) process.exitCode = 1;
       return;
     }
     if (opts.write) {
       if (plan.changed) {
-        (0, import_node_fs54.writeFileSync)(path2, plan.content, "utf8");
+        (0, import_node_fs56.writeFileSync)(path2, plan.content, "utf8");
         console.log(`mmi-cli devops org rules gitignore: updated .gitignore (${drift})`);
       } else {
         console.log("mmi-cli devops org rules gitignore: up to date");
@@ -54657,12 +54855,12 @@ ${r.stderr ?? ""}`).catch(() => "");
 var ENV_HEAL_LOCK_STALE_MS = 10 * 6e4;
 var ENV_HEAL_LOCK_MAX_WAIT_MS = 2 * 6e4;
 function envHealLockPath(home) {
-  return (0, import_node_path53.join)(home, ".claude", "plugins", ".mmi-env-heal.lock");
+  return (0, import_node_path54.join)(home, ".claude", "plugins", ".mmi-env-heal.lock");
 }
 async function withEnvHealLock(what, run) {
   try {
     return await withFileLock(
-      envHealLockPath((0, import_node_os24.homedir)()),
+      envHealLockPath((0, import_node_os25.homedir)()),
       { staleMs: ENV_HEAL_LOCK_STALE_MS, maxWaitMs: ENV_HEAL_LOCK_MAX_WAIT_MS, label: "mmi env-heal lock" },
       run
     );
@@ -54759,7 +54957,7 @@ function mmiDoctorDeps(opts = {}) {
       const configRoot = surfaceConfigRoot(surface);
       const running = surface === "codex" ? installedActivePluginVersion(surface) : runningPluginVersion(process.env, resolveClientVersion());
       const plan = buildPluginCachePlan(
-        (0, import_node_os24.homedir)(),
+        (0, import_node_os25.homedir)(),
         running,
         pluginCacheFsDeps(configRoot, () => 0),
         { configRoot, includeStaging: surface !== "codex" }
@@ -54787,14 +54985,14 @@ function mmiDoctorDeps(opts = {}) {
       const running = surface === "codex" ? installedActivePluginVersion(surface) : runningPluginVersion(process.env, resolveClientVersion());
       const installed = installedActivePluginVersion(surface);
       const plan = buildPluginCachePlan(
-        (0, import_node_os24.homedir)(),
+        (0, import_node_os25.homedir)(),
         running,
         pluginCacheFsDeps(configRoot, () => 0),
         { configRoot, includeStaging: surface !== "codex", installedVersion: installed }
       );
       const result = applyPluginCachePlan(
         plan,
-        (p) => (0, import_node_fs55.rmSync)(p, { recursive: true }),
+        (p) => (0, import_node_fs57.rmSync)(p, { recursive: true }),
         stagingApplyFsGuard(configRoot)
       );
       return {
@@ -54829,7 +55027,7 @@ function mmiDoctorDeps(opts = {}) {
     // has no generated routing index would
     // get a permanent — demanding an artifact it never asked for.
     docsIndexState: (root) => {
-      if (!(0, import_node_fs55.existsSync)((0, import_node_path53.join)(root, DOCS_INDEX_PATH))) return void 0;
+      if (!(0, import_node_fs57.existsSync)((0, import_node_path54.join)(root, DOCS_INDEX_PATH))) return void 0;
       const real = createDocsIndexDeps(root);
       let docs;
       const listDocs = () => docs ??= real.listDocs();
@@ -54838,7 +55036,7 @@ function mmiDoctorDeps(opts = {}) {
     },
     // #4168: working-tree heal — write if drifted, then re-check. Commit remains the operator's step.
     healDocsIndex: (root) => {
-      if (!(0, import_node_fs55.existsSync)((0, import_node_path53.join)(root, DOCS_INDEX_PATH))) return { drift: false, docCount: 0 };
+      if (!(0, import_node_fs57.existsSync)((0, import_node_path54.join)(root, DOCS_INDEX_PATH))) return { drift: false, docCount: 0 };
       const real = createDocsIndexDeps(root);
       let docs;
       const listDocs = () => docs ??= real.listDocs();
@@ -55187,14 +55385,17 @@ program2.addHelpText(
 var appActorCommand = "poll";
 function appActorDeps() {
   return {
-    fetchSecret: async (key) => fetchSecretValue(makeSecretsDeps(await loadConfig()), key, {
-      repo: APP_VAULT_REPO,
-      attribution: { command: appActorCommand, via: formatSessionIdentity(describeSessionIdentity()) }
-    }),
+    fetchSecret: async (key) => {
+      const deps = makeSecretsDeps(await loadConfig());
+      return readAppVaultSecret(() => fetchSecretValue(deps, key, {
+        repo: APP_VAULT_REPO,
+        attribution: { command: appActorCommand, via: formatSessionIdentity(describeSessionIdentity()) }
+      }, true));
+    },
     fetch: (url, init) => fetch(url, init)
   };
 }
-setPollTokenProvider(() => pollTokenOrUndefined(appActorDeps()));
+setPollTokenProvider(async () => activeAppToken() ?? pollTokenOrUndefined(appActorDeps()));
 var registerPreAction = Reflect.get(program2, ["h", "ook"].join(""));
 registerPreAction.call(program2, "preAction", async (_thisCommand, actionCommand) => {
   const commandPath3 = commandPathOf(actionCommand);
@@ -55218,8 +55419,9 @@ async function reportWrite(label, res) {
   return failGraceful(`${label}: HTTP ${res.status}${detail ? ` \u2014 ${detail}` : ""}`);
 }
 var tenant = program2.command("tenant").description("tenant runtime control through Hub authority");
-tenant.command("control <owner/repo> <stage> <action>").description("bounded tenant control plus value-free vault/broker verification; dev/main retire needs master and exact data-loss confirmation").option("--watch", "block on the dispatched run and report its conclusion (status/retire/verify-secrets/verify-broker/logs watch by default)").option("--lines <n>", "logs only: trailing lines of the tenant service to return (1-2000, default 200)").option("--since <utc>", "logs only: read the journal from this UTC time, e.g. 2026-10-07T13:10Z (includes replaced containers)").option("--until <utc>", "logs only: read the journal up to this UTC time").option("--edge", "logs only: Caddy journal for this stage\u2019s hosts (default window: last 15 minutes)").option("--task <name>", "run-task only: registry-declared task name (never a command)").option("--artifact <id>", "run-task only: opaque id returned by tenant artifact put").option("--confirm-data-loss <owner/repo/stage>", "dev/main retire only: exact target to decommission; without it show the dry-run plan").option("--json", "machine-readable output").action(async (repo, stage, action, o) => {
+tenant.command("control <owner/repo> <stage> <action>").description("bounded tenant control plus value-free vault/broker verification; dev/main retire needs master and exact data-loss confirmation").option("--watch", "block on the dispatched run and report its conclusion (status/retire/verify-secrets/verify-broker/logs watch by default)").option("--lines <n>", "logs only: trailing lines of the tenant service to return (1-2000, default 200)").option("--since <utc>", "logs only: read the journal from this UTC time, e.g. 2026-10-07T13:10Z (includes replaced containers)").option("--until <utc>", "logs only: read the journal up to this UTC time").option("--edge", "logs only: Caddy journal for this stage\u2019s hosts (default window: last 15 minutes)").option("--task <name>", "run-task only: registry-declared task name (never a command)").option("--artifact <id>", "run-task only: opaque id returned by tenant artifact put").option("--resume <run-id>", "run-task only: re-attach to an already-dispatched run (read-only, never re-dispatches) and print its receipt").option("--confirm-data-loss <owner/repo/stage>", "dev/main retire only: exact target to decommission; without it show the dry-run plan").option("--json", "machine-readable output").action(async (repo, stage, action, o) => {
   try {
+    if (o.resume !== void 0 && (action !== "run-task" || !/^\d+$/.test(o.resume) || o.task || o.artifact)) return fail("runtime tenant control: --resume <run-id> is run-task-only, takes a numeric run id, and cannot be combined with --task/--artifact");
     if (o.confirmDataLoss !== void 0 && (action !== "retire" || stage === "rc")) return fail("runtime tenant control: --confirm-data-loss is dev/main retire-only");
     if (action === "retire" && (stage === "dev" || stage === "main")) {
       if (o.confirmDataLoss !== void 0 && o.confirmDataLoss !== `${repo}/${stage}`) return fail(`runtime tenant control: --confirm-data-loss must match ${repo}/${stage} exactly`);
@@ -55244,11 +55446,11 @@ Dry run: pass --confirm-data-loss ${repo}/${stage} to decommission.`);
       if (!/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}(:\d{2})?Z$/.test(value)) return fail(`runtime tenant control: ${flag} must be a UTC time like 2026-10-07T13:10Z`);
     }
     if (action === "run-task") {
-      if (!o.task) return fail("runtime tenant control: run-task requires --task <declared-name>");
+      if (!o.task && o.resume === void 0) return fail("runtime tenant control: run-task requires --task <declared-name>");
     } else if (o.task || o.artifact) {
       return fail("runtime tenant control: --task/--artifact are valid only for run-task");
     }
-    const result = await runTenantControl(trainApplyDeps(), { repo, stage, action, watch: o.watch, lines: lines2, edge: o.edge, logSince: o.since, logUntil: o.until, task: o.task, artifact: o.artifact, confirmDataLoss: o.confirmDataLoss });
+    const result = await runTenantControl(trainApplyDeps(), { repo, stage, action, watch: o.watch, lines: lines2, edge: o.edge, logSince: o.since, logUntil: o.until, task: o.task, artifact: o.artifact, confirmDataLoss: o.confirmDataLoss, resume: o.resume === void 0 ? void 0 : Number(o.resume) });
     if (!o.json && action === "verify-secrets" && result.secrets) {
       const body = { ok: result.conclusion === "success", secrets: result.secrets, ssmStatus: result.conclusion === "success" ? "Success" : "Failed", raw: result.secretsRaw };
       const { lines: lines3, failure } = renderVerifySecrets(body);
@@ -55552,7 +55754,7 @@ project.command("set [owner/repo]").description("upsert project META (idempotent
   if (dupe) return fail(`org project set: KEY "${dupe}" was passed to both --var and --set; --set is an alias of --var, so pass each KEY once`);
   if (o.secretsFile) {
     try {
-      vars.push(`secrets=${(0, import_node_fs55.readFileSync)(o.secretsFile, "utf8")}`);
+      vars.push(`secrets=${(0, import_node_fs57.readFileSync)(o.secretsFile, "utf8")}`);
     } catch (e) {
       return fail(`org project set: cannot read --secrets-file ${o.secretsFile}: ${e.message}`);
     }
@@ -55821,9 +56023,11 @@ projectTenantTasks.command("declare <name>").description("register a NEW tenant
   if (!res.ok) process.exitCode = 1;
 });
 var registry = program2.command("registry").description("the DDB org registry \u2014 org-level constants");
-registry.command("org").description("the org config (account id, region, orgProjectId, sagaApiUrl)").option("--json", "machine-readable output").action(async (_o) => {
+registry.command("org").description("the org config (account id, region, orgProjectId, sagaApiUrl)").option("--json", "machine-readable output").option("--github-spend-minutes <minutes>", "master-only App spend by route, caller and pool over the last 1\u201360 minutes").action(async (_o) => {
+  const minutes = _o.githubSpendMinutes === void 0 ? void 0 : Number(_o.githubSpendMinutes);
+  if (minutes !== void 0 && (!Number.isInteger(minutes) || minutes < 1 || minutes > 60)) return fail("github-spend-minutes must be an integer from 1 to 60");
   const cfg = await loadConfig();
-  const org = await fetchOrgConfig(registryClientDeps(cfg));
+  const org = await fetchOrgConfig(registryClientDeps(cfg), minutes);
   if (!org) return failGraceful("org config get: Hub API unreachable, unseeded, or this repo is not bootstrapped");
   console.log(JSON.stringify(org));
 });
@@ -55940,16 +56144,16 @@ function ciAuditDeps2() {
     // gate re-seed step is skipped gracefully rather than failing mid-run.
     readSeedFile: (path2) => {
       if (!root) return null;
-      const fullPath = (0, import_node_path53.join)(root, path2);
-      return (0, import_node_fs55.existsSync)(fullPath) ? (0, import_node_fs55.readFileSync)(fullPath, "utf8") : null;
+      const fullPath = (0, import_node_path54.join)(root, path2);
+      return (0, import_node_fs57.existsSync)(fullPath) ? (0, import_node_fs57.readFileSync)(fullPath, "utf8") : null;
     }
   };
 }
 function hubRoot2() {
-  const fromPkg = (0, import_node_path53.join)(__dirname, "..", "..");
+  const fromPkg = (0, import_node_path54.join)(__dirname, "..", "..");
   const marker = "skills/bootstrap/seeds/manifest.json";
-  if ((0, import_node_fs55.existsSync)((0, import_node_path53.join)(fromPkg, marker))) return fromPkg;
-  if ((0, import_node_fs55.existsSync)((0, import_node_path53.join)(process.cwd(), marker))) return process.cwd();
+  if ((0, import_node_fs57.existsSync)((0, import_node_path54.join)(fromPkg, marker))) return fromPkg;
+  if ((0, import_node_fs57.existsSync)((0, import_node_path54.join)(process.cwd(), marker))) return process.cwd();
   return null;
 }
 registerQueryCommands(program2);
@@ -56079,10 +56283,10 @@ access.command("audit").description("audit collaborator roles + train-branch pus
     targets = resolution.targets;
   }
   const derivedMatrix = registryProjects ? accessMatrixFromProjects(registryProjects) : {};
-  const fileMatrix = (0, import_node_fs55.existsSync)("access-matrix.json") ? loadAccessMatrix((0, import_node_fs55.readFileSync)("access-matrix.json", "utf8")) : {};
+  const fileMatrix = (0, import_node_fs57.existsSync)("access-matrix.json") ? loadAccessMatrix((0, import_node_fs57.readFileSync)("access-matrix.json", "utf8")) : {};
   const matrix = mergeAccessMatrix(fileMatrix, derivedMatrix);
   const dataAccess = registryProjects ? dataAccessContractsFromProjects(registryProjects) : { consumers: {} };
-  const sanctioned = (0, import_node_fs55.existsSync)("access-matrix.json") ? loadSanctionedAdmins((0, import_node_fs55.readFileSync)("access-matrix.json", "utf8")) : {};
+  const sanctioned = (0, import_node_fs57.existsSync)("access-matrix.json") ? loadSanctionedAdmins((0, import_node_fs57.readFileSync)("access-matrix.json", "utf8")) : {};
   const report = await auditOrgAccess(targets, deps, matrix, dataAccess, sanctioned);
   console.log(o.json ? JSON.stringify(report, null, 2) : renderAccessReport(report));
   if (!report.ok) process.exitCode = 1;
@@ -56113,16 +56317,16 @@ function directoryBytes(path2) {
   let total = 0;
   let entries;
   try {
-    entries = (0, import_node_fs55.readdirSync)(path2, { withFileTypes: true });
+    entries = (0, import_node_fs57.readdirSync)(path2, { withFileTypes: true });
   } catch {
     return 0;
   }
   for (const entry of entries) {
-    const child2 = (0, import_node_path53.join)(path2, entry.name);
+    const child2 = (0, import_node_path54.join)(path2, entry.name);
     if (entry.isDirectory()) total += directoryBytes(child2);
     else {
       try {
-        total += (0, import_node_fs55.statSync)(child2).size;
+        total += (0, import_node_fs57.statSync)(child2).size;
       } catch {
       }
     }
@@ -56130,25 +56334,25 @@ function directoryBytes(path2) {
   return total;
 }
 function listDirEntries(dir) {
-  return (0, import_node_fs55.readdirSync)(dir, { withFileTypes: true }).map((d) => ({ name: d.name, isDirectory: d.isDirectory() }));
+  return (0, import_node_fs57.readdirSync)(dir, { withFileTypes: true }).map((d) => ({ name: d.name, isDirectory: d.isDirectory() }));
 }
 function readInstalledPluginRefs(configRoot) {
   const p = installedPluginsPathForConfig(configRoot);
-  if (!(0, import_node_fs55.existsSync)(p)) return [];
+  if (!(0, import_node_fs57.existsSync)(p)) return [];
   try {
-    return installedPluginPaths((0, import_node_fs55.readFileSync)(p, "utf8"));
+    return installedPluginPaths((0, import_node_fs57.readFileSync)(p, "utf8"));
   } catch {
     return null;
   }
 }
 function pluginCacheFsDeps(configRoot, dirBytes) {
   return {
-    exists: (p) => (0, import_node_fs55.existsSync)(p),
-    listVersionDirs: (root) => (0, import_node_fs55.readdirSync)(root, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name),
+    exists: (p) => (0, import_node_fs57.existsSync)(p),
+    listVersionDirs: (root) => (0, import_node_fs57.readdirSync)(root, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name),
     dirBytes,
-    listStagingDirs: (root) => (0, import_node_fs55.readdirSync)(root, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => {
+    listStagingDirs: (root) => (0, import_node_fs57.readdirSync)(root, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => {
       try {
-        return { name: d.name, mtimeMs: newestMtimeMs((0, import_node_path53.join)(root, d.name), listDirEntries, (p) => (0, import_node_fs55.statSync)(p).mtimeMs) };
+        return { name: d.name, mtimeMs: newestMtimeMs((0, import_node_path54.join)(root, d.name), listDirEntries, (p) => (0, import_node_fs57.statSync)(p).mtimeMs) };
       } catch {
         return { name: d.name, mtimeMs: Date.now() };
       }
@@ -56162,10 +56366,10 @@ function stagingApplyFsGuard(configRoot) {
   return {
     referencedPaths: () => readInstalledPluginRefs(configRoot),
     mtimeMs: (name) => {
-      const p = (0, import_node_path53.join)(stagingRoot, name);
-      if (!(0, import_node_fs55.existsSync)(p)) return null;
+      const p = (0, import_node_path54.join)(stagingRoot, name);
+      if (!(0, import_node_fs57.existsSync)(p)) return null;
       try {
-        return newestMtimeMs(p, listDirEntries, (q) => (0, import_node_fs55.statSync)(q).mtimeMs);
+        return newestMtimeMs(p, listDirEntries, (q) => (0, import_node_fs57.statSync)(q).mtimeMs);
       } catch {
         return null;
       }
@@ -56185,13 +56389,13 @@ program2.command("plugin-prune").description(`prune stale cached MMI plugin vers
     return;
   }
   const plan = buildPluginCachePlan(
-    (0, import_node_os24.homedir)(),
+    (0, import_node_os25.homedir)(),
     running,
     pluginCacheFsDeps(configRoot, directoryBytes),
     { withBytes: true, configRoot, includeStaging: surface !== "codex" }
   );
   const anythingToDelete = plan.prune.length > 0 || plan.staging.length > 0;
-  const result = o.apply && anythingToDelete ? applyPluginCachePlan(plan, (p) => (0, import_node_fs55.rmSync)(p, { recursive: true, force: true }), stagingApplyFsGuard(configRoot)) : void 0;
+  const result = o.apply && anythingToDelete ? applyPluginCachePlan(plan, (p) => (0, import_node_fs57.rmSync)(p, { recursive: true, force: true }), stagingApplyFsGuard(configRoot)) : void 0;
   const warnings = plan.prune.length > 0 ? [CONCURRENT_SESSION_WARNING] : [];
   if (o.json) console.log(JSON.stringify({ ...plan, warnings, applied: result ?? null }));
   else console.log(renderPluginCachePlan(plan, result));